BLACK BOX Advanced Console Server

Transcription

1 BLACK BOX Advanced Console Server Installation, Administration, and User s Guide Software Version BLACK BOX Corporation 1000 Park Drive Lawrence, PA Release Date: December 2005

2 2005 BLACK BOX Corporation, all rights reserved Information in this document is subject to change without notice. BLACK BOX is the registered trademark of BLACK BOX Corporation in the United States and other countries. All trademarks, trade names, logos and service marks referenced herein, even when not specifically marked as such, belong to their respective companies and are not to be considered unprotected by law.

3 Contents Before You Begin... 1 Audience... 1 Document Organization... 1 Related Documents... 3 BLACK BOX firmware Upgrades... 4 Chapter 1: Introduction... 7 Overview... 8 Product Models and Configurations... 8 Connectors on the BLACK BOX CS Accessing CS and Connected Devices Web Manager Prerequisites for Using the Web Manager Types of Users Security Authentication VPN Packet Filtering on CS Structure of IP Filtering Chain Rule Add Rule and Edit Rule Options SNMP Notifications, Alarms, and Data Buffering... 23

4 Contents Syslog Servers Prerequisites for Logging to Syslog Servers Administering Users of Connected Devices Planning Access to Connected Devices Configuring Access to Connected Devices CS and Power Management Configuring Power Management Configuring Ports for Power Management by Authorized Users 27 Configuring Ports for Power Management Using the CLI Options for Managing Power Power Management Through the Web Manager Power Management from the CS Command Line Chapter 2: Installation and Configuration Shipping Box Contents Important Pre-installation Requirements Java Plug-In Requirement for Serial Port Access Basic Installation Procedures Mounting the CS Making an Ethernet Connection Connecting Servers and Other Devices to CS Making a Direct Connection to Configure the Network Parameters Powering on the CS and the Connected Devices Configuring the Network Parameters Performing Basic Network Configuration Using the wiz Command Selecting A Security Profile Using the Web Manager Adding Users and Configuring Ports Using the Web Manager Enabling Ports and Assigning Users Other Methods of Accessing the Web Manager Installing PCMCIA Cards Connecting AlterPath PM IPDUs iv

5 Chapter 3: Web Manager for Regular Users Using the Web Manager Features of Regular User Forms Connect Connect to CS Connect to Serial Ports Port Access Requirements Connection Protocols for Serial Ports TCP Port Numbers for Serial Ports IPDU Power Mgmt Outlets Manager View IPDUs Info IPDU Multi-Outlet Ctrl Security Chapter 4: Web Manager for Administrators BLACK BOX Web Manager Prerequisites for Using the Web Manager Common Tasks for CS Administrators Common Features of Administrator Forms Buttons and CS Information Logging Into the Web Manager Overview of Administrative Modes Wizard Mode Expert Mode Chapter 5: Configuring CS in Wizard Mode Step 1: Security Profile Pre-defined Security Profiles Default Security Profile Custom Security Profile Serial Port Settings and Security Profiles Step 2: Network Settings BLACK BOX CS Installation, Administration, and User s Guide v

6 Contents Step 3: Port Profile Step 4: Access Step 5: Data Buffering Step 6: System Log Chapter 6: Configuring the CS in Expert Mode Overview of Menus and Forms Mapping of the Expert Mode Menus and Forms Description of Forms in Expert Mode Chapter 7: Applications Menu & Forms Applications Connect IPDU Power Mgmt Outlets Manager View IPDUs Info Users Manager Configuration Software Upgrade [for the AlterPath PM] IPDU Multi-Outlet Ctrl Prerequisites for Multi-Outlet Control Power Management Icons IPMI Power Management Terminal Profile Menu Chapter 8: Network Menu & Forms Network Host Settings Syslog PCMCIA Management Configuring a Modem PCMCIA Card Configuring an ISDN PCMCIA Card Configuring a GSM PCMCIA Card vi

7 Configuring an Ethernet PCMCIA Card Configuring a PCMCIA Compact Flash Card or a PCMCIA Hard Disk Drive Configuring a Wireless LAN PCMCIA Card Configuring a CDMA PCMCIA Card Ejecting a PCMCIA Card VPN Connections SNMP Firewall Configuration Host Table Static Routes Chapter 9: Security Menu & Forms Users and Groups Adding a User Adding a Group Active Ports Sessions Authentication Configuring Authentication for CS Logins Configuring Authentication Servers for Logins to CS and Connected Devices Group Authorization on TACACS Security Profiles Pre-defined Security Profiles Default Security Profile Custom Security Profile Serial Port Settings and Security Profiles Security Certificates Certificate for HTTP Security User Configured Digital Certificate X.509 Certificate on SSH Chapter 10: Ports Menu & Forms Physical Ports BLACK BOX CS Installation, Administration, and User s Guide vii

8 Contents General Connection Profiles Console Access Server (CAS) Profile Connection Protocols Terminal Server (TS) Profile Connection Protocols Bidirectional Telnet Protocol Modem and Power Management Connection Protocols Access Authentication Methods and Fallback Mechanism Data Buffering Multi User Power Management Other Virtual Ports Ports Status Ports Statistics Chapter 11: Administration Menu & Forms System Information Notifications Notifications Entry Pager Notifications Entry SNMP Trap Notifications Entry Serial Ports Alarm Notification Time/Date Setting Time and Date with NTP Boot Configuration Backup Configuration Upgrade Firmware Reboot Online Help Appendix A: Technical Specifications Appendix B: Safety, Regulatory, and Compliance In- viii

9 formation Safety Guidelines for Rack-Mounting the CS Safety Precautions for Operating the Advanced Console Server Working inside the Advanced Console Server Replacing the Battery FCC Warning Statement Notice About FCC Compliance for all Advanced Console Server Models Canadian DOC Notice Aviso de Precaución S-Mark Argentina Trabajar dentro del Advanced Console Server Batería Appendix C: Supported PCMCIA Cards Glossary Index BLACK BOX CS Installation, Administration, and User s Guide ix

10 Contents x

11 Tables Table v-1: Typographic Conventions... 3 Table v-2: Other Terms and Conventions... 4 Table 1-1: Model Numbers and Configuration Options... 8 Table 1-2: CS Supported Authentication Methods Table 1-3: Filter Options for Packet Filtering Rules Table 1-4: TCP Protocol Packet Filtering Options Table 1-5: UDP Protocol Packet Filtering Options Table 1-6: LOG Target Action Options Table 1-7: Tasks for Configuring Access to Connected Devices Table 1-8: Tasks for Configuring Power Management Table 1-9: Power Management Options in the Web Manager Table 2-1: Shipping Box Contents for LS1004A - LS1048A Table 2-2: Shipping Box Contents for LS1001A Table 2-3: CS Basic Installation Tasks Table 2-4: Tasks Related to Connecting AlterPath PMs Table 3-1: Common Screen Information Table 3-2: Java Applet Buttons Table 3-3: Serial Ports Connection Protocols Table 3-4: Regular User > Outlet Management Buttons Table 3-5: Regular User > Information on the View IPDUs Info Form Table 3-6: Regular User > IPDU Multi-Outlet Ctrl. Form Icons Table 3-7: Regular User > Password Management Form Table 4-1: Administrator > Common Administrative Tasks... 69

12 Tables Table 4-2: Administrator > Web Manager Buttons Table 4-3: Administrator > Options for Trying, Saving, and Restoring Configuration Changes Table 4-4: Administrator > Logout Button and Other Information in the Upper Right Table 4-5: Administrator > CS Configuration and Expert Menus Chapters Table 5-1: Wizard > Enabled services to access the CS under each security profile Table 5-2: Wizard > Enabled services to access the serial ports under each security profile Table 5-3: Wizard > Enabled protocols for each security profile shown with a check mark Table 5-4: Wizard > Serial Port Profile Parameters and Usage Table 5-5: Wizard > Add User Dialog: Field Names and Definitions Table 5-6: Wizard > Data Buffering Field Names and Definitions Table 5-7: Wizard > Differences Between Remote and Local Buffering Table 5-8: CS Configuration and Expert Menus Chapters Table 6-1: Expert Mode Menu and Forms Table 6-2: Expert > Applications Table 6-3: Expert > Network Table 6-4: Expert > Security Table 6-5: Expert > Ports Table 6-6: Administration Table 7-1: Expert > Applications Menu Table 7-2: Expert > Outlets Manager Icons Description Table 7-3: Expert > View IPDUs General Information Table 7-4: Expert > View IPDUs Unit Information Table 7-5: Expert > IPDU Multi-Outlet Ctrl form icons Table 7-6: Expert > IPMI Information Table 7-7: Expert > IPMI Power Mgmt. Form Icons Table 8-1: Expert > Network Menu xii

13 Table 8-2: Expert > Host Settings Form Fields Table 8-3: Expert > Form Fields for a Modem Card Table 8-4: Expert > Form Fields for an ISDN Card Table 8-5: Expert > Form Fields For a GSM Card Table 8-6: Expert > Form Fields for an Ethernet Card Table 8-7: Expert > Form Fields for a Compact Flash/Hard Disk 173 Table 8-8: Expert > Form Fields for a Wireless LAN Card Table 8-9: Expert > Form Fields for a CDMA Card Table 8-10: Expert > Field and Menu Options for Configuring a VPN Connection Table 8-11: Expert > Fields and Menu Options for SNMP Configuration Table 8-12: Expert > Tasks for Configuring SNMP Table 8-13: Expert > TCP Options Fields Table 8-14: Expert > UDP Options Fields Table 8-15: Expert > Firewall Configuration Input and Output Interface, and Fragments Fields Definitions Table 8-16: Expert > Target LOG Options Selection Fields Table 8-17: Expert > Reject Options Sections Table 8-18: Expert > Fields and Menus for Configuring Static Routes Table 9-1: Expert > Security Menu Table 9-2: Expert > Add User Dialog Field Names and Definitions Table 9-3: Expert > Active Ports Sessions Information Table 9-4: Tasks for Setting up Authentication Servers Table 9-5: Expert > Enabled services to access the CS under each security profile Table 9-6: Expert > Enabled services to access the serial ports under each security profile Table 9-7: Expert > Enabled protocols for each security profile shown with a check mark Table 9-8: Configuring CS in Expert Mode Table 10-1: Expert > Ports Menu BLACK BOX CS Installation, Administration, and User s Guide xiii

14 Tables Table 10-2: Expert > Console Connection Protocols Table 10-3: Expert > Terminal Server (TS) Connected Protocols Table 10-4: Expert > Protocols for Serial Ports Connected to Modems or IPDUs Table 10-5: Expert > Access Form Fields Table 10-6: Expert > Authentication Methods Table 10-7: Expert > Procedures to Configure an Authentication Server Table 10-8: Expert > Data Buffering Form Fields Table 10-9: Expert > Multi User Form Fields Table 10-10: Expert > Options on the Allow Multiple Sessions Menu Table 10-11: Expert > Power Management Form Fields Table 10-12: Expert > Ports > Physical Ports > Other Form Fields. 280 Table 10-13: Expert > New/Modify Port Dialog Box Fields Table 10-14: Expert > Port Status Read-Only Form Table 10-15: Expert > Ports>Port Status Read-Only Form Table 11-1: Expert > Administration Menu Table 11-2: System Information Table 11-3: Expert > Notifications Form Fields Table 11-4: Expert > Notifications Dialog Box Fields Table 11-5: Expert > Pager Notifications Dialog Box Table 11-6: Expert > SNMP Trap Notifications Dialog Box Table 11-7: Expert > Boot Configuration Form Fields Table 11-8: Expert > Backup Config Type FTP Form Fields and Buttons Table 11-9: Expert > Backup Config Type Storage Device Form Table 11-10: Expert > Upgrade Firmware Form Fields Table C-1: Supported PCMCIA Cards xiv

15 Figures Figure 1-1: CS Front with PCMCIA Card Slots... 8 Figure 1-2: CS Back with Connectors... 8 Figure 1-3: BLACK BOX CS family of Advanced Console... Servers... 9 Figure 1-4: CS Connectors Figure 1-5: IPDU Integration With CS Figure 2-1: CS Setup Example Figure 2-2: Security Advisory Console Message Figure 2-3: Front Panel PCMCIA Card Slots Figure 2-4: PCMCIA Eject Button in Web Manager Figure 2-5: AlterPath PMs Connected to the CS Figure 3-1: Regular User > Web Manager Login form Figure 3-2: Regular User Form Figure 3-3: Regular User > Connect Form Figure 3-4: Java Applet Figure 3-5: Regular User > IPDU Power Mgmt. Forms Figure 3-6: Regular User > Outlets Manager (no permissions) Figure 3-7: Regular User > Outlets Manager (with permissions).. 59 Figure 3-8: Regular User > View IPDUs Info Figure 3-9: Regular User > IPDU Multi-Outlet (no permissions). 63 Figure 3-10: Regular User > IPDU Multi-Outlet (wit permissions)...

16 Figures Figure 4-1: Administrator > Web Manager Buttons Figure 4-2: Administrator > Web Manager Login Form Figure 4-3: Administrator > Multi Administrator Login Message 74 Figure 4-4: Administrator > Security Advisory Message Figure 4-5: Example of Web Manager Form in Wizard Mode Figure 4-6: Example of Web Manager Form in Expert Mode Figure 5-1: Administrator > Physical Ports Factory Settings Figure 5-2: Security and Serial Ports Configuration Alert Figure 5-3: Security Advisory Dialog Box Figure 5-4: Wizard > Step 1: Security Profile Form Figure 5-5: Custom Security Profile Dialog Box Figure 5-6: Wizard > Step 2: Network Settings - DHCP disabled. 88 Figure 5-7: Wizard > Step 2: Network Settings - DHCP enabled. 89 Figure 5-8: Wizard > Step 3: Port Profile Figure 5-9: Wizard > Step 4:Access Figure 5-10: Wizard > Step 4: Access Add User Dialog Box Figure 5-11: Wizard > Step 4: Change Password Dialog Box Figure 5-12: Wizard > Step 5: Data Buffering [Inactive] Figure 5-13: Wizard > Step 5: Data Buffering [Local] Figure 5-14: Wizard > Step 5: Data Buffering [Remote] Figure 5-15: Wizard > Step 6: System Log Figure 6-1: Expert Mode Screen Elements Figure 7-1: Expert > Applications Menu Options Figure 7-2: Expert > Applications > Connect Form Figure 7-3: Expert > SSH session Java Applet Figure 7-4: Expert > Serial Port Java Applet Figure 7-5: Expert > IPDU Power Mgmt. Tab Options Figure 7-6: Expert > Applications > IPDU Power Mgmt. > Outlets xvi

17 Manager Figure 7-7: Expert > Outlets Manager Icons Figure 7-8: Expert > Edit Outlets Dialog Box Figure 7-9: IPDU Power Mgmt. > View IPDUs Info Figure 7-10: IPDU Power Mgmt> Users Manager Figure 7-11: Expert > IPDU Power Mgmt. > Users Manager > Add User Figure 7-12: Expert > Applications > IPDU Power Mgmt. > Configuration Figure 7-13: Expert > Applications > IPDU Power Mgmt. > Software Upgrade Figure 7-14: Expert > Applications > IPDU Multi-Outlet Ctrl Figure 7-15: Expert > Applications > Multi-Outlet Ctrl [not configured] Figure 7-16: Expert > Applications > Multi-Outlet Control Icons138 Figure 7-17: Expert > Applications > IPMI Power Mgmt Figure 7-18: Expert > IPMI Power Mgmt. Add/Edit IPMI Device Dialog Boxes Figure 7-19: Expert > IPMI Power Mgmt. Device Entry Example142 Figure 7-20: Expert > Serial Port > Power Management > Enable Power Management Figure 7-21: Expert > Power Management Add Outlet Dialog Box Figure 7-22: Expert > Serial Port > Power Management > User Permissions Figure 7-23: Expert > Serial Port > Power Management > Enable IPMI Figure 7-24: Expert > Applications > Terminal Profile Menu Figure 7-25: Expert >Terminal Profile Menu Add Option Dialog BLACK BOX CS Installation, Administration, and User s Guide xvii

18 Figures Box Figure 7-26: Expert > Terminal Profile Menu Example Figure 8-1: Expert > Network > Host Settings [DHCP Enabled] 154 Figure 8-2: Expert > Network > Host Settings [DHCP Disabled]155 Figure 8-3: Expert > Network > Syslog Figure 8-4: Expert > Network > PCMCIA Management Figure 8-5: Expert > PCMCIA Modem Card Configuration Dialog Box Figure 8-6: Expert > PCMCIA Modem Card Configuration Dialog Box -PPP Figure 8-7: Expert > Modem PCMCIA Card Configuration Dialog Box - Call Back Figure 8-8: Expert > ISDN PCMCIA Card Configuration Dialog Box Figure 8-9: Expert > GSM PCMCIA Card Configuration Dialog Box Figure 8-10: Expert > GSM PCMCIA Card Configuration Dialog Box - Call Back Figure 8-11: Expert > Ethernet PCMCIA Card Configuration Dialog Box Figure 8-12: Expert > PCMCIA Compact Flash/Hard Disk Configuration Dialog Box Figure 8-13: Expert > PCMCIA Wireless LAN Card Configuration Dialog Box Figure 8-14: Expert > PCMCIA CDMA Card Configuration Dialog Box Figure 8-15: Expert > Network > VPN Connections Figure 8-16: Expert > VPN New/Modify Connection Dialog Box Figure 8-17: Expert > Network > SNMP xviii

19 Figure 8-18: Expert > New/Mod SNMP v1 v2 Configuration Dialog Box Figure 8-19: Expert > New/Mod SNMP v3 Configuration Dialog Box Figure 8-20: Expert > Network > Firewall Configuration Figure 8-21: Expert > Firewall Configuration Edit Chain Dialog Box Figure 8-22: Firewall Configuration User-defined Chain Message Figure 8-23: Firewall Configuration Delete Default Chain Message Figure 8-24: Expert > Firewall Configuration Add Chain Dialog Box Figure 8-25: Firewall Configuration Edit Rules for chain_name Form Figure 8-26: Firewall Configuration Edit Rules for chain_name Buttons Figure 8-27: Expert > Firewall Configuration Add Rule and Edit Rule Dialog Boxes Figure 8-28: Firewall Configuration Add Rule and Edit Rule... Target Menu Options Figure 8-29: Firewall Configuration Add Rule and Edit Rule Source and Destination IP and Mask Fields Figure 8-30: Firewall Configuration Add Rule and Edit Rule Protocol Menu Options Figure 8-31: Firewall Configuration Add Rule and Edit Rule Numeric Protocol Fields Figure 8-32: Firewall Configuration Add Rule and Edit Rule TCP Protocol Fields and Menu Options BLACK BOX CS Installation, Administration, and User s Guide xix

20 Figures Figure 8-33: Firewall Configuration Add Rule and Edit Rule UDP Protocol Fields Figure 8-34: Firewall Configuration Add Rule and Edit Rule ICMP Type Menu Options Figure 8-35: Firewall Configuration Input and Output Interface Fields and Fragments Menu Options Figure 8-36: Firewall Configuration Add Rule and Edit Rule LOG Target Fields Figure 8-37: Firewall Configuration Add Rule and Edit Rule REJECT Target Menu Options Figure 8-38: Expert > Network > Host Tables Figure 8-39: Expert > Network > Static Routes Figure 8-40: Expert > Static Routes Add and Edit Dialog Boxes - Default Route Figure 8-41: Expert > Static Routes Add and Edit Dialog Boxes - Network Route Figure 8-42: Expert > Static Routes Add and Edit Dialog Boxes - Host Route Figure 9-1: Expert > Security > Users and Groups Form Figure 9-2: Expert > Security > Users and Groups > Add User Dialog Box Figure 9-3: Expert > Security > Users and Groups > Add Group Dialog Box Figure 9-4: Expert > Security > Active Ports Sessions Figure 9-5: Expert > Security > Authentication Figure 9-6: Expert > Security > Authentication > AuthType Form Figure 9-7: Expert > Security > Authentication > Radius Figure 9-8: Expert > Security > Authentication > TACACS Figure 9-9: Expert > Security > Authentication > LDAP xx

21 Figure 9-10: Expert > Administration > Time/Date Figure 9-11: Expert > Security > Authentication > Kerberos Figure 9-12: Expert > Security > Authentication > NIS Figure 9-13: Expert > Security > Security Profile Figure 9-14: Expert > Physical Ports Default Factory Settings Figure 9-15: Security Profile and Serial Ports Configuration Alert232 Figure 9-16: Serial Ports Protocol Incompatibility Dialog Box Figure 9-17: Security Advisory Dialog Box Figure 9-18: Wizard > Step 1: Security Profile Form Figure 9-19: Custom Security Profile Dialog Box Figure 10-1: Expert > Ports Figure 10-2: Expert > Ports > Physical Ports Figure 10-3: Expert > Ports > Physical Ports > Modify... Ports Tab Options Figure 10-4: Expert > Ports > Physical Ports > General Form Figure 10-5: Expert > Ports > Physical Ports > Console Connection Active Tabs Figure 10-6: Expert > Ports > Physical Ports > Console Connection Figure 10-7: Connection Protocols > Console Figure 10-8: Expert > Ports > Physical Ports > Bidirectional Telnet Active Tabs Figure 10-9: Expert > Ports > Physical Ports > Bidirectional Telnet Connection Figure 10-10: Connection Protocols > Bidirectional Telnet Figure 10-11: Expert > Ports > Physical Ports > Terminal Server Active Tabs Figure 10-12: Expert > Ports > Physical Ports > Terminal Server Connection BLACK BOX CS Installation, Administration, and User s Guide xxi

22 Figures Figure 10-13: Connection Protocols > Terminal Server Figure 10-14: Expert > Ports > Physical Ports > Modem Connection Active Tabs Figure 10-15: Expert > Ports > Physical Ports > Modem Connection Figure 10-16: Connection Protocols > Modem Figure 10-17: Expert > Ports > Physical Ports > Power Management Active Tabs Figure 10-18: Expert > Ports > Physical Ports > Power Management Connection Figure 10-19: Connection Protocols > Power Management Figure 10-20: Access > Authentication Types Figure 10-21: Expert > Ports > Physical Ports > Serial Port Settings Figure 10-22: Expert > Ports > Physical Ports > Access Form Figure 10-23: Expert > Ports > Physical Ports > Data Buffering Figure 10-24: Expert > Ports > Physical Ports > Data Buffering Figure 10-25: Expert > Port > Physical Ports >Multi User Figure 10-26: Expert > Ports > Physical Ports > Power Management Figure 10-27: Expert > Ports > Physical Ports > Power Management Figure 10-28: Expert > Ports > Physical Ports > Power Management > Add Outlets Dialog Box Figure 10-29: Expert > Ports > Physical Ports > Power Management>Allow All Users Figure 10-30: Expert > Ports > Physical Ports >Power Management >Allow Users/ Groups Figure 10-31: Expert > Ports > Physical Ports > Other Form Figure 10-32: Expert > Ports > Virtual Ports xxii

23 Figure 10-33: Expert > Ports > Virtual Ports > New/Modify Port Dialog Box Figure 10-34: Expert > Applications > Connect > Serial pull-down menu Figure 10-35: Expert > Ports > Virtual Ports > New/Modify Port Dialog Box Figure 10-36: Expert > Ports > Virtual Ports > New/Modify > Port Names Dialog box Figure 10-37: Expert > Ports > Ports Status (Read-Only) Figure 10-38: Expert > Ports > Port Statistics (Read-Only) Figure 11-1: Expert > Administration > System Information Figure 11-2: Expert > Administration > Notifications Figure 11-3: Expert > Administration > Notifications > > Add/ Edit Dialog box Figure 11-4: Expert > Administration > Notifications > Pager > Add/ Edit Dialog box Figure 11-5: Expert > Administration > Notifications > SNMP Trap > Add/Edit Dialog box Figure 11-6: Expert > Administration > Time/Date Figure 11-7: Expert > Administration > Time/Date > NTP Enable308 Figure 11-8: Expert > Administration > Boot Configuration Figure 11-9: Expert > Administration > Backup Config Figure 11-10: Expert > Administration > Backup Config > Storage Device Figure 11-11: Expert > Administration > Upgrade Firmware Figure 11-12: Expert > Administration > Reboot Figure 11-13: Expert > Administration > Online Help BLACK BOX CS Installation, Administration, and User s Guide xxiii

24 Figures xxiv

25 Procedures To check Java Plug-in Support in the Browser To Install JRE Version or later and Register the Plug-in To rack-mount CS, perform the following steps: To Make an Ethernet Connection To Connect Devices to Serial Ports To Connect to the Console Port To Power on the CS To Turn Power On Connected Devices To Log Into CS Through the Console To Change the root password To Use the wiz Command to Configure Network Parameters To Select a Security Profile To Use a Dynamic IP Address to Access the Web Manager To Use the Default IP Address to Access the Web Manager To Install a PCMCIA Card To Remove a PCMCIA Card To Configure a PCMCIA Card To Daisy-Chain AlterPath PMs to the CS Logging in to the Web Manager To Use Telnet to Connect to a Device Through a Serial Port To Close a Telnet Session To Use SSH to Connect to a Device Through a Serial Port To Close an SSH Session To Change Your Password... 65

26 Procedures To Log Into the Web Manager To Select or Configure a Security Profile To configure the Network Settings To Set Parameters for All Serial Ports To Add a User To Delete a User To Change a Password To Configure Data Buffering To Add a Syslog Server To Delete a Syslog Server To Connect to the CS To Connect to a Device Through a Serial Port To View Status, Lock, Unlock, Rename, or Cycle Power Outlets To View and Reset IPDU Information To Configure Users to Manage Power Outlets on IPDUs To Specify Names, Alarms, Syslogging, and Over Current Protection for IPDUs To Download AlterPath PM Software From BLACK BOX To Upgrade Software on an AlterPath PM To Power On or Power Off a Group of Outlets in the Same Power State139 To Power On or Power Off a Group of Outlets in Different Power States To Lock or Unlock a Group of Outlets in the Same Power State To Lock or Unlock a Group of Outlets in Different Lock States To Turn the Power of a Group of Outlets Off and On Again To Delete, Add, or Edit an IPMI Device to Enable or Disable IPMI Power Management To Manage Power on an IPMI Device To Configure a Serial Port for IPDU or IPMI Power Management To Configure a User for IPDU Power Management While Connected To a Serial Port To enable IPMI Power Management of an IPMI device connected to the currently-selected port To Create a Menu for a Local Computer Terminal xxvi

27 To Configure Host Settings [Expert] To Configure Syslogging for Serial Ports and Specify Message Filtering To Configure a PCMCIA Card To Configure a Modem PCMCIA Card To Configure an ISDN PCMCIA Card To Configure a GSM PCMCIA Card To Configure an Ethernet PCMCIA Card To Configure a Compact Flash PCMCIA Card or a PCMCIA Hard Disk Drive To Configure a Wireless LAN PCMCIA Card To Configure a CDMA PCMCIA Card To Eject a PCMCIA Card From the Card Slot To Configure VPN To Configure SNMP To Add a Chain To Edit a Chain To Add a Rule To Edit a Rule To Define the CS s IP Address and Hostname To Configure Static Routes [Expert] To Add a User To Delete a User or Group To Change a User s Password To Add a Group To Modify a Group To View, Kill, or Refresh Active User Sessions To Configure the CS Login Authentication Method To Configure a RADIUS Authentication Server To Configure a TACACS+ Authentication Server To Configure an LDAP Authentication Server To Configure a Kerberos Authentication Server To Configure a NIS Authentication Server To Select or Configure a Security Profile BLACK BOX CS Installation, Administration, and User s Guide xxvii

28 Procedures To Select One or More Serial Ports To Enable or Disable Serial Ports To Configure a Serial Port Connection Protocol for a Console Connection To Configure a Serial Port Connection Protocol for a Bidirectional Telnet To Configure a Serial Port Connection Protocol for a Terminal Server To Configure a Serial Port Connection Protocol for an External Modem To Configure a Power Management Protocol for an IPDU To Associate an Alias to a Serial Port To Configure Serial Port Settings to Match the connected devices To Configure User Access to Serial Ports To Configure a Serial Port Login Authentication Method To Configure Data Buffering for Serial Ports To Configure Multiple Sessions and Port Sniffing for One or More Serial Ports To Configure a Serial Port for IPDU or IPMI Power Management To Configure a User for IPDU Power Management While Connected To a Serial Port To Configure TCP Port Number, STTY Options, Break Interval, and the Login Banner for a Serial Port Connected to a Console To Configure Terminal Server Connection Options To Cluster CS Units or Modify Cluster Configuration To Assign Names to Slave ports in the Cluster To View System Information To Choose a Method for Sending Notifications for Serial Port Data Buffering Events To Configure a Trigger for Notification for Serial Ports To Configure a Trigger for Pager Notification for Serial Ports To Configure a Trigger for SNMP Trap Notification for Serial Ports To Configure a Trigger for Serial Port Alarm Notification To Manually Set the Time and Date To Configure Time and Date Using an NTP Server To Configure CS Boot xxviii

29 To Back Up or Restore the Configuration Files using an FTP Server To Back Up or Restore the Configuration Files using a Storage Device 315 To Upgrade the CS s firmware To Reboot the CS To Configure the Online Help Path BLACK BOX CS Installation, Administration, and User s Guide xxix

30 Procedures xxx

31 Before You Begin This installation, administration, and user s guide provides background information and procedures for installing, configuring, and administering the BLACK BOX Advanced Console Server and for accessing connected servers and other connected devices. Audience This manual is intended for installers and system administrators of the CS and for users who may be authorized to connect to devices, to manage power through the CS, and to monitor the CS s temperature. This document describes configuration, administration, and use of the CS only. It does not describe how to set up and administer other external services or servers that the CS may access for authentication, system logging, IPMI control, SNMP notifications, data logging, file sharing, or other purposes. This document assumes that users who are authorized to connect to servers and other devices through the CS already know how to use the connected devices. Document Organization The document contains the following chapters: 1: Introduction An overview of the features of the Advanced Console Server and necessary prerequisite information for understanding the rest of the information in this guide. 2: Installation and Configuration A list of tasks for installing and configuring the Advanced Console Server and connecting devices, with pointers to the needed background information and procedures.

32 Before You Begin 3: Web Manager for Regular Users Describes how authorized users use the Web Manager to access devices that are connected to ports on the CS. 4: Web Manager for Administrators Explains how the CS administrator uses the Web Manager to add and delete users, define port access, and perform other common administration tasks. 5: Configuring CS in Wizard Mode Describes the 6-step procedure to configure the Advanced Console Server in Wizard mode. Selecting a Security Profile, configure network settings, configure serial ports and access, and configure settings such as data buffering and system logging. 6: Configuring the CS in Expert Mode Provides an introduction to the Expert mode. Describes the forms in each section, and provides a mapping to each form with a link to the desired section. 7: Applications Menu & Forms Provides an overview of each form associated with the Applications menu, describes the functionality of the individual elements in each form, and provides step-by-step configuration procedures. 8: Network Menu & Forms Provides an overview of each form associated with the Network menu, describes the functionality of the individual elements in each form, and provides step-by-step configuration procedures. 9: Security Menu & Forms Provides an overview of each form associated with the Security menu, describes the functionality of the individual elements in each form, and provides step-by-step configuration procedures. 2

33 Related Documents 10: Ports Menu & Forms Provides an overview of each form associated with the Ports menu, describes the functionality of the individual elements in each form, and provides stepby-step configuration procedures. 11: Administration Menu & Forms Provides an overview of each form associated with the Administration menu, describes the functionality of the individual elements in each form, and provides step-by-step configuration procedures. Appendices Index Appendix A provides hardware specifications, and Appendix B details safety information. Provides a way to look up terms. In the online version of this manual, clicking the terms in the index brings you to where they are used in the manual. Related Documents The following document for the BLACK BOX Advanced Console Server is shipped with the product. Advanced Console Server Quick Start Guide (hard-copy) Typographic and Other Conventions The following table describes the typographic conventions used in BLACK BOX manuals. Table v-1: Typographic Conventions Typeface Meaning Example Links Hypertext links or URLs Go to: BLACK BOX CS Installation, Administration, and User s Guide 3

34 Before You Begin Table v-1: Typographic Conventions Typeface Meaning Example Emphasis Filename or Command User type Titles, emphasized or new words or terms Names of commands, files, and directories; onscreen computer output. What you type in an example, compared to what the computer displays See the Advanced Console Server Quick Start. Edit the pslave.conf file. [root] ifconfig eth0 The following table describes other terms and conventions. Table v-2: Other Terms and Conventions Term or Convention Meaning Examples Hot keys Navigation shortcuts When hot keys are shown with a plus (+) between two or three keys means that they must be pressed at the same time. Shortcuts use the greater than symbol (>) to indicate how to navigate to Web Manager forms. Pressing Ctrl+p brings up the IPMI power management. Go to Port > Physical Ports> Modify Selected Ports > Power Management BLACK BOX firmware Upgrades BLACK BOX offers periodic firmware upgrades for the Advanced Console Server. These upgrades are available free of charge to current BLACK BOX customers. Visit ftp://ftp.blackbox.com/lan/term-servers/ to download the latest firmware. See Upgrade Firmware on page 313 for instructions on how to upgrade the firmware on your Advanced Console Server. 4

35 Introduction This chapter introduces the Advanced Console Server family of advanced console servers, provides an overview of its features, and briefly describes the features for understanding the information and procedures in the rest of this manual. Overview Page 6 Advanced Console Server Models and Configurations Page 6 Connectors on the Advanced Console Server Page 8 Methods of Accessing CS and Connected Devices Page 8 Web Manager Page 9 Prerequisites for Using the Web Manager Page 9 Types of Users Page 10 Security Features Page 10 Authentication Page 11 VPN Page 13 Packet Filtering Page 13 SNMP Page 20 Notifications, Alarms, and Data Buffering Page 21

36 Introduction Overview Administering Users of Connected Devices Page 22 Power Management Page 23 The Advanced Console Server is a 1U device that serves as a single access point for using and administering servers and other devices. The following figure shows the front of the CS with its two PCMCIA card slots, and the back of a LS1032A with its Serial, Ethernet, and Console ports. Figure 1-1: LS1032A Front and back with PCMCIA Card Slots Product Models and Configurations The following table shows the available configurations. See Appendix A for hardware specifications. Table 1-1: Model Numbers and Configuration Options Model Number Serial Ports LS1001A 1 LS1004A 4 6

37 Product Models and Configurations Table 1-1: Model Numbers and Configuration Options Model Number Serial Ports LS1008A 8 LS1016A 16 LS1032A 32 LS1048A 48 The following figure illustrates the BLACK BOX family of advanced console servers. Figure 1-2: BLACK BOX CS family of Advanced Console Servers BLACK BOX CS Installation, Administration, and User s Guide 7

38 Introduction Connectors on the BLACK BOX CS The following figure depicts the connectors on the back of a LS1008A. Serial Ports Ethernet Port Power Supply Console Port Figure 1-3: LS1008A Connectors The number of serial ports and power supplies depends on the model, see table 1-1 for model numbers and configurations options. Accessing CS and Connected Devices You can access CS and the connected servers or devices locally or remotely using any of the following methods. Using the Web Manager through LAN/WAN IP networks. Using a modem, ISDN, GSM, or CDMA optional PCMCIA card. Using the Web Manager you can login and launch a console session such as Telnet or SSH to connect to the console of devices that are connected to the CS s serial ports. By connecting a computer running a terminal emulation program, an CS administrator can log into the CS box and enter commands in the CS shell or use the Command Line Interface (CLI) tool. Note: Only one user logged in as root or admin can have an active CLI or Web Manager session. A second user who connects through the CLI or the Web Manager as the root or admin has a choice to abort the session or close the other user s session. 8

39 Web Manager Note: If there are cron jobs running through automated scripts, a root or admin user login can cause the automated cron jobs to fail. Make sure that the users with administrative privileges are aware of this. Web Manager CS administrators perform most tasks through the Web Manager either locally or from a remote location. The Web Manager runs in a browser and provides a real-time view of all the equipment that is connected to the CS. The CS administrator can use the Web Manager to configure users and ports. An authorized user can access connected devices through the Web Manager to troubleshoot, maintain, recycle power, and reboot connected devices. Access to the Web Manager is through one of the following ways: Through the IP Network. Through a dial-in or callback connection with one of the following: An optional external modem connected to one of the serial ports. A modem on an optional PCMCIA modem card. An optional CDMA, GSM, or ISDN card. Prerequisites for Using the Web Manager The prerequisites described in this section must be complete before anyone can access the Web Manager. If you have questions about any of the following prerequisites, contact your system or network administrator. Basic network parameters must be defined on the CS so the Web Manager can be launched over the network. See Performing Basic Network Configuration Using the wiz Command on page 38. The IP address of the CS must be known. When DHCP is enabled, a leased IP address is assigned to CS. The leased IP address may change every time CS reboots. Therefore, an additional step needs to be taken to find out the dynamically-assigned IP address before the Web Manager can be accessed through the browser. Following are three ways to find out the dynamically-assigned IP address: BLACK BOX CS Installation, Administration, and User s Guide 9

40 Introduction Types of Users Make an inquiry to the DHCP server on the subnet that the CS resides, using the MAC address (The MAC address is labeled at the bottom of the CS). Connect to CS remotely using Telnet or SSH and use the ifconfig command. Connect directly to the CS and use the ifconfig command through a terminal emulator application. A user account must be defined on the Web Manager. By default, the admin has an account on the Web Manager. An administrator can add regular user accounts to grant access to the connected servers or devices using the Web Manager. CS supports the following user account types: The root user who can manage the CS and its connected devices. The root user performs the initial network configuration. Access privileges are full read/write and management. Note: It is strongly recommended to change the default password bb before setting up the CS for secure access to the connected servers or devices. Security Users who can be part of an Admin group with administrative privileges. This may be a regular user who can perform the same tasks as an administrator. Regular users who can access the connected devices through the serial ports they are authorized for. Regular users have limited access to the Web Manager features. The Advanced Console Server includes a set of security profiles that consists of predefined parameters to control access to CS and its serial ports. This feature provides more control over the services that are active at any one time. As an additional security measure, all serial ports are disabled by default, which allows the administrator to enable and assign individual ports to users. See Security Profiles on page 226 for detailed information and procedures. 10

41 Authentication Authentication CS supports a number of authentication methods that can help the administrator with the user management. Authentication can be performed locally or with a remote server, such as RADIUS, TACACS+, LDAP, or Kerberos. An authentication security fallback mechanism is also employed, should the negotiation process with the authentication server fails. In such situations, the CS follows an alternate defined rule when authentication server is down or does not authenticate the user. The following table lists the supported authentication methods. Table 1-2: CS Supported Authentication Methods Authentication Type Definition None Kerberos Kerberos/Local KerberosDownLocal LDAP LDAP/Local LDAPDownLocal Local Local/Radius No authentication. Authentication is performed using a Kerberos server. Kerberos authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the Kerberos server is down. Authentication is performed against an LDAP database using an LDAP server. LDAP authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the LDAP server is down. Authentication is performed locally. For example using the /etc/passwd file. Authentication is performed locally first, switching to Radius if unsuccessful. BLACK BOX CS Installation, Administration, and User s Guide 11

42 Introduction Authentication Type Local/TACACS+ Local/NIS NIS NIS/Local NISDownLocal Radius Radius/Local RadiusDownLocal TACACS+ TACACS+/Local TACACS+DownLocal Definition Authentication is performed locally first, switching to TACACS+ if unsuccessful. Authentication is performed locally first, switching to NIS if unsuccessful. NIS authentication is performed. NIS authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the NIS server is down. Authentication is performed using a Radius authentication server. Radius authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the Radius server is down. Authentication is performed using a TACACS+ authentication server. TACACS+ authentication is tried first, switching to Local if unsuccessful. Local authentication is tried only when the TACACS+ server is down. 12

43 VPN VPN The CS administrator can set up VPN connections to establish an encrypted communications between the CS and a host on a remote network. The encryption creates a security tunnel for a dedicated communications. You can use the VPN features on CS to create the following types of connections: A secure tunnel between CS and a gateway at a remote location so every machine on the subnet at the remote location has a secure connection with CS. Create a secure tunnel between CS and a single remote host To set up a security gateway, you can install IPSec on any machine that does networking over IP, including routers, firewall machines, application servers, and end-user machines. The ESP and AH authentication protocols are supported. RSA Public Keys and Shared Secret are also supported. For detailed information and procedures to configure a VPN connection, see VPN Connections on page 176. Packet Filtering on CS The CS administrator can configure the box to filter packets like a firewall. IP filtering is controlled by chains and rules. Structure of IP Filtering The Firewall Configuration form in the Web Manager is structured on two levels: The view table of the Firewall Configuration form which contains a list of chains. The chains which contain the rules that control filtering. BLACK BOX CS Installation, Administration, and User s Guide 13

44 Introduction Chain Rule A chain is a named profile that includes one or more rules that define the following: A set of characteristics to look for in a packet What to do with any packet that has all the defined characteristics The CS filter table contains a number of built-in chains. The CS administrator can define additional chains and can edit the built-in chains. The built-in chains are referenced according to the type of packet they handle as shown in the following list: INPUT - For incoming packets. FORWARD - For packets being routed through CS. OUTPUT - For outgoing packets. As defined in the rules for the default chains, all input and output packets, and packets being forwarded are accepted. Each chain can have one or more rules that define the following: The packet characteristics being filtered. The packet is checked for characteristics defined in the rule. For example, a specific IP header, input and output interfaces, TCP flags and protocol. What to do when the packet matches the rule. The packet can be handled according to a specified target policy such as accepted, dropped, returned, logged, or rejected. When a packet is filtered, its characteristics are compared against the rules one-by-one. All defined characteristics must match. If no rules are found then the default action for that chain is applied. Administrators can do the following to specify packet filtering: Add a new chain and specify rules for that chain Add new rules to existing chains Edit a built-in chain or delete the built-in chain rules 14

45 Packet Filtering on CS Add Rule and Edit Rule Options When you add or edit a rule you can define any of the options described in the following table. Table 1-3: Filter Options for Packet Filtering Rules Filter Options Source IP and Mask Destination IP and Mask Protocol Input Interface Output Interface Fragments Description If you specify a source IP, incoming packets are filtered for the specified IP address. If you specify a destination IP, outgoing packets are filtered for the specified IP address. If you fill in a source or destination mask, incoming or outgoing packets are filtered for IP addresses from the subnetwork in the specified netmask. You can select a protocol for filtering from one of the following options: ALL Numeric Protocol Options TCP Protocol Options UDP Protocol Options ICMP Protocol Options The input interface (ethn) used by the incoming packet. The output interface (ethn) used by the outgoing packet. The types of packets to be filtered: All packets 2nd, 3rd... fragmented packets Non-fragmented and 1st fragmented packets You can flag any of the above elements with inverted so that the target action is performed on packets that do not match any of the criteria specified in that line. For example, if you select DROP as the target action, specify Inverted for a source IP address, and do not specify any other criteria in the rule, any BLACK BOX CS Installation, Administration, and User s Guide 15

46 Introduction packets arriving from any other source IP address than the one specified are dropped. Numeric Protocol Options If you select Numeric as the protocol when specifying a rule, you need to specify the desired number. TCP Protocol Options If you select TCP as the protocol when specifying a rule, you can define the following options. Table 1-4: TCP Protocol Packet Filtering Options Field/Menu Option Source Port - OR - Destination Port TCP Flags Definition You can specify a source or destination port number for filtering in the Source Port or Destination Port field. You can also specify a range so that TCP packets are filtered for any port number within the range. Specifying any of the flags: SYN (synchronize), ACK (acknowledge), FIN (finish), RST (reset), URG (urgent), PSH (push), and one of the Any, Set, or Unset conditions, filters TCP packets for the specified flag and the selected condition. 16

47 Packet Filtering on CS UDP Protocol Options When you select UDP as a protocol when specifying a rule, you can select the UDP options defined in the following table. Table 1-5: UDP Protocol Packet Filtering Options Field Source Port - OR - Destination Port Definition Specify a source or destination port number for filtering in the Source Port or Destination Port field. You can specify a source or destination port number for filtering in the Source Port field. You can also specify a second number so that UDP packets are filtered for any port number within the range. ICMP Protocol Options When you select ICMP as a protocol when specifying a rule, you can select the following ICMP options. all echo-reply destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence violation BLACK BOX CS Installation, Administration, and User s Guide 17

48 Introduction precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS-host-redirect echo-request router-advertisement router-solicitation time-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply Target Actions The Target is the action to be performed on an IP packet that matches all the criteria specified in a rule. The target actions are: ACCEPT DROP RETURN LOG REJECT 18

49 Packet Filtering on CS If the LOG and REJECT targets are selected, additional options are available. The following table describes the options for the LOG Target. Table 1-6: LOG Target Action Options Options Log Level Definition emerg alert crit err warning notice info debug Log Prefix TCP Sequence TCP Options IP Options The prefix to use in the log entry. Includes the TCP sequence in the log. Includes TCP options in the log. Includes IP options in the log. The following list shows the options for the REJECT Target: icmp-net-unreachable icmp-host-unreachable icmp-port-unreachable icmp-proto-unreachable icmp-net-prohibited icmp-host-prohibited echo-reply tcp-reset BLACK BOX CS Installation, Administration, and User s Guide 19

50 Introduction Firewall Configuration Procedures The following table has links to the procedures for defining packet filtering using the Web Manager. To Add a Chain Page 199 To Edit a Chain Page 199 To Add a Rule Page 200 To Edit a Rule Page 201 SNMP The CS administrator can activate Simple Network Management Protocol (SNMP) agent that resides on the CS so that the SNMP agent sends notifications about significant events or traps to an SNMP management application. The CS SNMP agent supports SNMP v1/v2 and v3. The following table shows the tasks related to administering SNMP on the CS and provides links to where they are documented. To Configure SNMP To configure one or more serial ports to send SNMP traps. See To Configure SNMP on page 184. See SNMP Trap Notifications Entry on page

51 Notifications, Alarms, and Data Buffering Notifications, Alarms, and Data Buffering The CS administrator can setup logging, notifications, and alarms to alert administrators about problems. System generated messages on CS and the connected servers or devices can be sent to syslog servers for handling. The administrator can also configure data buffering to store data from communication on serial ports for monitoring. Data from communication with serial-connected consoles can be stored: Locally in the CS s flash memory, or Remotely either on an NFS server or a syslog server. Syslog Servers Messages about the CS and connected servers or devices can be sent to a central logging servers, called syslog servers. Console data from devices connected to serial ports can be stored in data buffer files on syslog servers. By default logging and data buffering are not done. Prerequisites for Logging to Syslog Servers Before configuring syslogging, the CS administrator must ensure that syslog server is pre-configured with a public IP address, and it is accessible from CS. The CS administrator must be able to obtain the following information from the syslog server s administrator. The IP address of the syslog server The facility number for messages coming from the CS. Facility numbers are used on the syslog server for handling messages generated by multiple devices. Facility Numbers for Syslog Messages Each syslog server has seven local facility numbers available for its administrator to assign to different devices or groups of devices at different locations. The available facility numbers are Local0 through Local7. BLACK BOX CS Installation, Administration, and User s Guide 21

52 Introduction An Example of Using Facility Numbers The syslog system administrator sets up a server called syslogger to handle log messages from two CS boxes. One CS is located in São Paulo, Brazil, and the other in Fremont, California. The syslog server s administrator wants to aggregate messages from the São Paulo CS into the local1 facility, and to aggregate messages from Fremont CS into the local2 facility. On syslogger the system administrator has configured the system logging utility to write messages from the local1 facility to the /var/log/ saopaulo-config file and the messages from the local2 facility to the / var/log/fremont-config file. If you were in Fremont and identifying the syslog server using the Web Manager, according to this example, you would select the facility number Local2 from the Facility Number pull-down menu on the Syslog form. Administering Users of Connected Devices This sections provides a list of task that an CS administrator can perform to enable access to connected devices. Planning Access to Connected Devices The CS administrator needs to perform specific tasks to setup and configure user access to the connected servers, IPDUs, or other devices. An advanced planning can minimize issues that may arise during software configuration. Some of the planning steps includes the following: Create a list of servers or devices to connect to the serial ports. Create a list of users with the type of access each user requires. Create a matrix of users and required access to each connected server or device. Create meaningful aliases to assign to port numbers. List all devices that need to be connected to IPDUs and the users who need to access them. 22

53 CS and Power Management Configuring Access to Connected Devices During hardware installation of CS, the installer connects the servers, devices, and any IPDUs to the serial ports. During software configuration, the CS administrator performs the common tasks listed in the following table. Table 1-7: Tasks for Configuring Access to Connected Devices Task Configure a serial port connection protocol for a console connection Where documented Page 246 Configure user access to serial ports. Page 261 Configure a serial port for IPDU or IPMI power management Configure a user for IPDU power management Page 274 Page 276 CS and Power Management CS enables users who have power management permissions to power off, power on, and reboot devices. The CS offers the following power management options: Remote power management of servers that have IPMI controllers. The CS's implementation of the Intelligent Platform Management Interface (IPMI) protocol lets authorized users manage power for servers that have embedded IPMI controllers. IPMI servers do not need to be connected to the CS because their IPMI controllers respond to out-of-band IPMI BLACK BOX CS Installation, Administration, and User s Guide 23

54 Introduction commands. Authorized users can also perform IPMI power management of serially-connected devices. The CS uses IPMI V1.5. Remote power management of devices that are plugged into an IPDU that is connected to CS The intelligent power distribution unit (IPDU) can be an AlterPath PM connected to any serial port. Up to 128 IPDU outlets can be daisychained. The diagram below shows a typical setup of the CS and an AlterPath PM unit. Figure 1-4: IPDU Integration With CS Configuring Power Management Administrators commonly perform power management through the Web Manager, to assign power management permissions to users, configure IPMI devices, and configure ports for power management. 24

55 CS and Power Management The following table list the tasks for power management and where they are described. Table 1-8: Tasks for Configuring Power Management Task Configure users to manage power on IPDUs Identify servers for IPMI power management Configure ports for power management by authorized users Where Documented To Configure a User for IPDU Power Management While Connected To a Serial Port on page 276 To Delete, Add, or Edit an IPMI Device to Enable or Disable IPMI Power Management on page 142 To Configure a Serial Port for IPDU or IPMI Power Management on page 274. Configuring Ports for Power Management by Authorized Users Administrators of connected devices who have power management permissions can do power management while connected by using a hot key that brings up a power management screen. For IPMI power management the default hot key is Ctrl+p. For IPDU power management the default hot key is Ctrl+Shift+I. Configuring Ports for Power Management Using the CLI CS administrators can use the CLI command with the config ipmi options to manage power on IPMI devices while logged into the CS with administrative rights. The ipmitool command is documented in the BLACK BOX Advanced Console Server Command Reference Guide. BLACK BOX CS Installation, Administration, and User s Guide 25

56 Introduction Options for Managing Power The sections listed below describe the different ways that the authorized users can perform power management through CS. From forms in the Web Manager From a power management screen while logged into a device From the command line while logged into CS An authorized user with administrative privileges can perform IPDU and IPMI power management. A Regular User with permissions to the connected devices can perform IPDU power management. Power Management Through the Web Manager Users with power management permissions can perform power management through the Web Manager. The Web Manager menu includes the two power management options listed in the following table, with links to where each is documented. Table 1-9: Power Management Options in the Web Manager Form Name Where Documented IPDU Power Mgmt IPDU Power Mgmt. on page 120 To View Status, Lock, Unlock, Rename, or Cycle Power Outlets on page 123 IPMI Power Mgmt IPMI Power Management on page 139 To Delete, Add, or Edit an IPMI Device to Enable or Disable IPMI Power Management on page 142 To Manage Power on an IPMI Device on page 143 Power Management from the CS Command Line CS administrators can use the ipmitool command to manage power on IPMI devices while logged into the CS with administrative rights. The ipmitool command is documented in the BLACK BOX Advanced Console Server Command Reference Guide. 26

57 Chapter 2 Installation and Configuration This chapter covers the topics listed in the following table. Shipping Box Contents Page 28 Important Pre-Installation Requirements Page 32 Basic Installation Procedures Page 34 Other Methods of Accessing the Web Manager Page 45 Installing PCMCIA Cards Page 46 Connecting AlterPath PM IPDUs Page 47 The following figure illustrates an example of an CS configured with connected devices.

58 Installation and Configuration Figure 2-1: CS Setup Example Shipping Box Contents The shipping box contains the CS along with the items shown in Table 2-1 and Table 2-2 for CS4 through CS48, and CS1 respectively. The entry for each part provides an illustration, its part number, description, and purpose. You can use checkboxes to check off each item, and you can use the part numbers from this table to reorder any of the parts. The list is numbered for internal cross-referencing among descriptions within this table. Table 2-1: Shipping Box Contents for LS1004A - LS1048A R Item Description Purpose 1. Documentation CD PDF copies of this guide. 28

59 Shipping Box Contents R Item Description Purpose 3. Power cable. To connect the CS to a power source. 4. RJ45 to DB25F crossover adapter To connect the console port to a computer that has a DB-25 male connector. 5. RJ45 to DB25M crossover adapter To connect the console port to a computer that has a DB-25 female connector. 6. RJ45 to DB9F crossover adapter To connect the console port to a computer that has a DB-9 connector. 7. Sun/Netra crossover adapter To connect the console port to a Sun Netra server, or other devices with the same pinout configuration. 8. RJ45 to RJ45 7ft. CAT5 cable Use for the following: To connect a device or an IPDU to a serial port. To connect an Ethernet port to the LAN. To connect a terminal to a console port. BLACK BOX CS Installation, Administration, and User s Guide 29

60 Installation and Configuration R Item Description Purpose 9. RJ45 to DB25M straight-thru cable Use for modems and other DCE devices. 10. DB25F Loopback Use to test and diagnose serial ports Mounting brackets with 10 - screws (2 spares) Use to mount the CS to a rack or cabinet. 30

61 Shipping Box Contents Table 2-2: Shipping Box Contents for LS1001A R Item Description Purpose 1. Documentation CD PDF copies of this guide. 3. RJ45 to DB9F crossover adapter To connect the console port to a computer that has a DB-9 connector. 4. DB25F Loopback Use to test and diagnose serial ports mm Block Plug Use to establish RS-485 connection. 6. DB9F to DB25M adapter Use to convert serial port connectors. 7. Bumpon Protect Pads Adhesive pads to protect and stabilize CS1. BLACK BOX CS Installation, Administration, and User s Guide 31

62 Installation and Configuration 8. RJ45 to RJ45 7ft. CAT5 cable Use for the following: To connect a device or an IPDU to a serial port. To connect an Ethernet port to the LAN. To connect a terminal to a console port. 9. DB9F to DB25F crossover cable To connect the RS-232 serial port to a computer that has a DB-25 male connector. 10. Power Supply +5V/2.5A Power supply. 11. Power Cable 6ft. 2-Pin To connect the CS to a power source. Important Pre-installation Requirements Before installing and configuring CS, ensure that you have the following: Root Access on your local UNIX machine in order to use the serial ports. An appropriate Terminal application for your operating system. IP address, DNS, Network Mask, and Gateway addresses of your server or terminal, the CS, and the machine that CS is connected to. A web browser that supports the CS Web Manager, such as Netscape, Internet Explorer 6.0, Firefox, or Mozilla. Java 2 Runtime Environment (JRE) version or later. J2RE can be downloaded from 32

63 Important Pre-installation Requirements Java Plug-In Requirement for Serial Port Access The JRE version or later must be installed for a user to be able to access a serial port using the Java applet viewing window. After you download and install J2RE version or later, check your browser configuration to see if the Java plug-in is configured with your browser. To check Java Plug-in Support in the Browser 1. To check Internet Explorer on Windows, do the following steps. a. Go to Tools > Internet Options > Advanced b. Scroll down and look for a section on Java. c. There should be a check box that says Use Java 2 v " As shown in the following figure. d. If an option similar to the above figure does not appear, it means that JRE is not installed on your system. Or, if the option appears, but the checkbox is not enabled, this means your browser is not activated to use the Java plug-in that came with JRE. 2. To check Netscape or Mozilla on Windows, do the following steps. a. Go to Edit > Preferences >Advanced. b. Check the Enable Java checkbox. c. To see what version of the Java plug-in is registered, do the following steps. i. Go to Help > About Plug-ins. ii. Scroll to the Java Plug-in section. iii. Check whether the registered Java plug-in is the same as the version you installed. To Install JRE Version or later and Register the Plug-in 1. Make sure that JRE or later is installed on the computer. BLACK BOX CS Installation, Administration, and User s Guide 33

64 Installation and Configuration If needed, download the JRE from The web site automatically checks your configuration and installs the latest version of JRE if one is not available. 2. If JRE is already installed on your system and you just want to activate your browser, do the following steps. a. Go to your system's Control Panel > Java Plug-in > Browser b. Enable the browser(s) for Java Plug-in. c. Test your browser(s) to see if the correct Java Plug-in is being used. Basic Installation Procedures Task The following table lists the basic installation tasks in the order in which they should be performed and shows the page numbers where the tasks are described in more detail. Table 2-3: CS Basic Installation Tasks Where Documented Mount the CS Mounting the CS on page 35 Make an Ethernet connection Making an Ethernet Connection on page 35 Connect servers and other devices to be managed through the CS Make a direct (terminal) connection to prepare CS for basic network configuration Power on the CS and the connected devices Perform basic network configuration Select a security profile using the web manager Connecting Servers and Other Devices to CS on page 36 Making a Direct Connection to Configure the Network Parameters. on page 37 Powering on the CS and the Connected Devices on page 37 Performing Basic Network Configuration Using the wiz Command on page 38 Selecting A Security Profile Using the Web Manager on page 43 34

65 Basic Installation Procedures Mounting the CS You can mount the CS on a wall, rack, or cabinet, or place it on a desktop or other flat surface. Two brackets are supplied with six hex screws for attaching the brackets to CS for mounting. See item 14 in the shipping content section. If you are not mounting the CS, place the unit on a desk or table. If you are rack-mounting the CS, obtain a hex screwdriver and appropriate nuts and bolts before starting the following procedure. To rack-mount CS, perform the following steps: 1. Install the brackets on to the front or back edges of the box using a screw driver and the screws provided with the mounting kit. brackets 2. Mount the CS box in a secure position. Note: To ensure safety refer to Appendix B: Safety Guidelines. Making an Ethernet Connection You can use the RJ-45 straight-through cable and the appropriate adapter provided in the product box to assemble a console cable. All adapters have an RJ-45 connector on one end and either a DB25 or DB9 male or female connector on the other end. BLACK BOX CS Installation, Administration, and User s Guide 35

66 Installation and Configuration To Make an Ethernet Connection 1. Connect the RJ-45 end of the cable to the port labeled Console on the CS. 2. Connect the adapter end of the cable to the console port of your server or device. 3. Connect a patch cable from the CS port labeled 10/100Base-T to an Ethernet hub or switch. Connecting Servers and Other Devices to CS The following sections describes the recommended preparation for connecting servers or devices to CS. Make sure the configuration on servers or devices to be connected are completed. Work with the administrator of the servers or devices to ensure all the following prerequisites are met: All devices are installed and fully configured. User accounts exist for the users who need access to the server or device. If a device is to use remote authentication, make sure that the authentication servers are installed and fully configured You have obtained from the server s administrator the information (IP address and other method-specific information), which you need to configure the authentication server on the CS. To Connect Devices to Serial Ports Using patch cables with RJ-45 connectors and DB-9 console adapters assemble crossover cables to connect the CS serial ports to the device s console port. Note: After CS is installed make sure to specify the desired authentication method to CS and the serial ports that each device is connected to. See Authentication on page 214 for more information on configuring authentication to CS, and Physical Ports on page 239 for detail information on configuring the serial ports. 36

67 Basic Installation Procedures Making a Direct Connection to Configure the Network Parameters. Perform the following steps to connect a terminal or a computer to the console port of the CS. This procedure assumes you know how to use a terminal or terminal emulation program. On a PC, ensure that HyperTerminal or another terminal emulation program is installed on the Windows operating system. On a computer running a UNIXbased operating system, such as Solaris or Linux, make sure that a compatible terminal emulator such as Kermit or Minicom is installed. To Connect to the Console Port 1. Install and launch your serial communication software on a terminal or a computer. For example, if you are using a PC, use HyperTerminal to perform the initial configuration of the CS directly through your PC s COM port. 2. Open HyperTerminal. Start > All Programs > Accessories > Communications > HyperTerminal 3. Start a New Connection session, select an available COM port, and enter the following console parameters. Bits per second: 9600 bps Data bits: 8 bits Parity: None Stop bit: 1 Flow control: None Powering on the CS and the Connected Devices Do the following procedures in the order shown to avoid problems with components on connected devices. To Power on the CS 1. Make sure the CS s power switch is off. 2. Plug in the power cable. 3. Turn the CS s power switch(es) on. BLACK BOX CS Installation, Administration, and User s Guide 37

68 Installation and Configuration Note: If your CS model is equipped with dual power supplies, make sure you turn both power switches on. After system initialization, a beep sound may warn if one of the power supplies is off. To Turn Power On Connected Devices Turn on the power switches of the connected devices only after you have completed the physical connection to CS. Configuring the Network Parameters In preparation to make CS available on the network, collect the following information from your system administrator and proceed with the network configuration procedure. Hostname An IP address for CS Domain name DNS IP address Gateway IP address Network mask NTP server s IP address (if you are using a time/date server) Performing Basic Network Configuration Using the wiz Command The following procedure assumes that a hardware connection is made between the CS s console port and the COM port of a computer. To Log Into CS Through the Console From your terminal emulation application, log into the console port as root. CS login: root Password: bb 38

69 Basic Installation Procedures Note: It is strongly recommended to change the default password bb before setting up the CS for secure access to the connected servers or devices. To Change the root password 1. Enter the passwd command. root]# passwd d. Enter a new password when prompted. New password: new_password Re-enter new password: new_password Password changed The following Security Advisory appears the first time CS is powered on, or when the unit is reset to factory default parameters. BLACK BOX CS Installation, Administration, and User s Guide 39

70 Installation and Configuration Figure 2-2: Security Advisory Console Message Important - Security Advisory! Console Management provides critical access to management features of attached equipment. Please take the required precautions to understand the potential impacts this device may have to your SECURITY policies. From factory, this device is configured as follows: - single password for ROOT; - all serial port DISABLED; - DHCP, Telnet, SSHv1 & SSHv2 and HTTP & HTTPS enabled. The following actions are STRONGLY recommended: 1. To change the ROOT user's password before setting up the device. 2. That you SELECT A SECURITY PROFILE to complete the INITIAL SETUP. Security is dependent on Policy and is Configurable to fit in environments with varying levels of Security. This device provides three pre-set Security Levels: SECURED, MODERATE and OPEN, and in addition, the ability to set a CUSTOM Security Profile. 3. Do not leave the equipment idle WITHOUT selecting a SECURITY PROFILE. 4. To ENABLE Serial Ports and CONFIGURE them using Web UI or CLI. Refer to the Quick Start Guide or the User's Guide for Security Profile selection details and Serial Port configuration. To Use the wiz Command to Configure Network Parameters 1. Launch the Configuration Wizard by entering the wiz command. [root@cas root]# wiz 40

71 Basic Installation Procedures As shown in the sample screen below, the system brings up the configuration wizard banner and begins running the wizard. 2. At the prompt, enter n to change the defaults. Set to defaults (y/n)[n]: n 3. Press Enter to accept the default hostname, otherwise enter your own hostname. Hostname [CAS]: fremont_branch_cs 4. Press Enter to keep DHCP enabled, or enter n to specify a static IP address for CS. By default, CS uses the IP address provided by the DHCP server. If your network does not use DHCP, then CS will default to Do you want to use DHCP to automatically assign an IP for your system? (y/n)[y] : BLACK BOX CS Installation, Administration, and User s Guide 41

72 Installation and Configuration 5. To change the default static IP address, see your network administrator to obtain a valid IP address. System IP[ ]: CS_IP_address 6. Enter the domain name. Domain name[blackbox.com]: domain_name 7. Enter the IP address for the Primary DNS (domain name) server. Primary DNS Server[ ] : DNS_server_IP_address 8. Enter the IP address for the gateway. Gateway IP[eth0] : gateway_ip_address 9. Enter the netmask for the subnetwork. Network Mask[#] : netmask The network configuration parameters appear. 10. Enter y after the prompts shown in the following screen example. Are all these parameters correct? (y/n)[n]: y Do you want to activate your configurations now? (y/n)[y]: y Do you want to save your configuration to Flash? (y/n)[n]: y 11. To confirm the configuration, enter the ifconfig command. 12. After the initial configuration proceed to the Web Manager to select a security profile. 42

73 Basic Installation Procedures Note: To use the Web Manager, ask your system administrator for the CS s IP address. CS may be set up with a static IP address at your site. By default, CS uses the IP address provided by the DHCP server. If your network does not use DHCP, then CS defaults to Selecting A Security Profile Using the Web Manager After the initial configuration, connect to the Web Manager by entering the IP address of the CS in a supported browser. Note: Once you login to the Web Manager, a Security Profile must be selected in order to further configure CS using the Web Manager. For this reason your browser redirects to Wizard > Step1: Security Profiles. To Select a Security Profile Select a pre-defined Security Profile, or define a Custom profile for specific services. The profiles are: Secured: Disables all protocols except SSHv2, HTTPS, and SSH to Serial Ports. Moderate: Enables SSHv1, SSHv2, HTTP, HTTPS, Telnet, SSH and Raw connections to Serial Ports, ICMP, and HTTP redirection to HTTPS. Open: Enables all services, Telnet, SSHv1, SSHv2, HTTP, HTTPS, SNMP, RPC, ICMP and Telnet, SSH and Raw connections to Serial Ports. Default: Sets the profile to the same configuration as Moderate. Custom: Enable or disable individual protocols and services, and configure access to ports. For detailed information on Security Profiles see Security Profiles on page 226. The administrator can perform the following tasks using the Web Manager. Administer CS and its connected devices. Configure user and group permissions. BLACK BOX CS Installation, Administration, and User s Guide 43

74 Installation and Configuration Access the serial ports and the connected devices. Adding Users and Configuring Ports Using the Web Manager Enabling Ports and Assigning Users. Note: From the factory, CS is configured with all serial ports disabled. The administrator can add users, enable or disable the serial ports, and select and assign specific users to individual ports. For detailed information on managing users and ports see Appendix 9, Security Menu & Forms" and Appendix 10, Ports Menu & Forms". For additional configuration and administration options, and other important related information, see the chapters in the CS user manual that are listed in the following table. Topic Installation and Configuration Process. For Regular Users - How to use the Web Manager to access servers and connected devices. Web Manager in Wizard Mode. Web Manager in Expert Mode. Where Documented Appendix 2, Installation and Configuration" Appendix 3, Web Manager for Regular Users" Appendix 5, Configuring CS in Wizard Mode" Appendix 6, Configuring the CS in Expert Mode" 44

75 Other Methods of Accessing the Web Manager Other Methods of Accessing the Web Manager You can access the Web Manager using one of the following methods. Note: The following methods require additional setup and configuration, which could be specific to your site s network configuration. Using DHCP Using the default IP address To Use a Dynamic IP Address to Access the Web Manager This procedure assumes that DHCP is enabled, and that you are able to obtain the dynamic IP address that is currently assigned to CS. 1. Mount the BLACK BOX CS. 2. Connect computers and other devices to be managed through the CS. 3. Power on the CS and connected devices. 4. Obtain the CS s current IP address. 5. Enter the CS s IP address in the browser s Address window. 6. Login to the CS and finish configuring users and other settings using the Web Manager. To Use the Default IP Address to Access the Web Manager The default IP address for the CS is This procedure assumes that you are able to temporarily change the IP address of a computer that is on the same subnet as the CS. 1. On a computer that resides on the same subnet as the CS, change the network portion of the IP address of that computer to For example, you could change the computer s IP address to For the host portion of the IP address, you can use any number except 10, 0, or 255. BLACK BOX CS Installation, Administration, and User s Guide 45

76 Installation and Configuration 2. Bring up a browser on the computer whose address you changed, enter the CS s default IP address, to bring up the Web Manager, and log in. Installing PCMCIA Cards The front panel of the CS has two PCMCIA card slots as shown in the following figure. You can insert and configure one card in each of the slots. See Appendix C, Supported PCMCIA Cards". PCMCIA Slots Figure 2-3: Front Panel PCMCIA Card Slots To Install a PCMCIA Card 1. Insert the PCMCIA card into slot 1 or slot Use the Web Manager to configure the PCMCIA card. Note: A hard disk PCMCIA card is automatically mounted once it is inserted, and it needs no configuration. To Remove a PCMCIA Card Caution: Always use the Web Manager to eject a PCMCIA card. Any other method may cause a kernel panic. 1. Eject the card by using the Eject button on the Web Manager s PCMCIA Management form, Expert > Network > PCMCIA Management > Eject 46

77 Connecting AlterPath PM IPDUs Figure 2-4: PCMCIA Eject Button in Web Manager 2. Physically remove the card from the slot. To Configure a PCMCIA Card See Chapter 8, To Configure a PCMCIA Card, and the sections related to the type of card you need to configure. Connecting AlterPath PM IPDUs You can connect AlterPath Power Management (PM) intelligent power distribution units (IPDUs) to the serial ports on the CS using an RJ-45 to RJ- 45 UTP cable. AlterPath PM includes two RS-232 outlets for serial management and daisy-chaining. Any combination of Alter PM models up to 128 outlets can be daisy-chained into a single virtual power distribution unit. The following figure shows an CS and two AlterPath PM8 IPDUs daisychained. One PM is connected to a serial port on CS configured for power management, and a second PM is daisy-chained from the first PM. BLACK BOX CS Installation, Administration, and User s Guide 47

78 Installation and Configuration Figure 2-5: AlterPath PMs Connected to the CS The following table lists the related tasks on connecting IPDU units and managing power. Table 2-4: Tasks Related to Connecting AlterPath PMs Task Configure serial ports for power management protocol. How the administrators perform IPDU power management using the Web Manager How the regular users manager power outlets using the Web Manager Connect the AlterPath PM to the CS unit, and daisy-chain multiple PM units. Configure users for IPDU power management Configure servers for IPMI power management while connected. Where Documented To Configure a Serial Port for IPDU or IPMI Power Management on page 274 IPDU Power Mgmt. on page 120 To Close an SSH Session on page 56 To Daisy-Chain AlterPath PMs to the CS on page 48 To Configure Users to Manage Power Outlets on IPDUs on page 128 To Delete, Add, or Edit an IPMI Device to Enable or Disable IPMI Power Management on page 142 To Daisy-Chain AlterPath PMs to the CS This procedure assumes that you have one AlterPath PM connected to a serial port on the CS. 1. Connect one end of a UTP cable with RJ-45 connectors to the OUT port of the AlterPath PM that is connected to the serial port on CS. 2. Connect the other end of the cable to the IN port of the next AlterPath PM. 3. Repeat Steps 1 and 2 until you have connected the desired number of AlterPath PMs. 48

79 Chapter 3 Web Manager for Regular Users This chapter describes the requirements and the procedures for Regular Users to use the Web Manager. Regular users are those who have configured accounts on the CS with limited access rights. Regular users can perform the following tasks using the Web Manager. Access computers and devices that are connected to the serial ports on the CS. Perform IPDU power management. Change their current password. This chapter contains the following sections. Using the Web Manager Page 49 Features of Regular User Forms Page 51 Connect Form Page 52 IPDU Power Management Page 56 IPDU Multi-Outlet Control Page 60 Security Page 63 Using the Web Manager CS users perform most tasks through the Web Manager. The Web Manager runs in a browser and provides a real-time view of all the equipment that is connected to the CS.

80 Web Manager for Regular Users The CS administrator can use the Web Manager to configure users and ports. An authorized user can access connected devices through the Web Manager to troubleshoot, maintain, recycle power, and reboot connected devices. Logging in to the Web Manager 1. Connect your web browser to CS by typing in the Console Access Server s IP address (e.g., provided to you by your system administrator in your internet browser. Note: Refer to Chapter 2, for the requirements to start with the Web Manager. Press Enter. The system brings up the CS Web Manager Login form. 2. Type in your username and password as provided to you by your system administrator. Figure 3-1: Regular User > Web Manager Login form 50

81 Features of Regular User Forms Features of Regular User Forms The following figure shows features of the Web Manager when regular users log in. Form area Logout button and CS information area Menu Figure 3-2: Regular User Form The form in the middle changes according to which menu option is selected. The following table illustrates the functions that are common to all the forms. Table 3-1: Common Screen Information Form Area Purpose Click this button to log out. BLACK BOX CS Installation, Administration, and User s Guide 51

82 Web Manager for Regular Users Table 3-1: Common Screen Information (Continued) Form Area Purpose Displays the hostname and IP address assigned during initial configuration, and the model number of the CS. Brings up the online help. Connect When you select the Connect option, the following form appears. Figure 3-3: Regular User > Connect Form You can use this form to connect to the CS console, or to one of the serial ports as described in the following sections. Connect to CS on page 53 Connect to Serial Ports on page 54 Permission to access a port or perform power management is granted by the CS administrator when your user account is created. Contact your administrator to gain authorization to access the serial port that the server or devices is connected to. 52

83 Connect Connect to CS When you click the Connect to CS radio button on the Connect form, a Java applet viewer appears running an SSH session on the CS. The following figure shows the Java applet when you connect to the CS. Note in the Connected to message in the below figure at the top of the screen the IP address of the CS followed by the session type, in this case SSH. Figure 3-4: Java Applet The following table describes the available buttons in the Java applet: Table 3-2: Java Applet Buttons Button Purpose To send a break to the terminal BLACK BOX CS Installation, Administration, and User s Guide 53

84 Web Manager for Regular Users Table 3-2: (Continued)Java Applet Buttons Button Purpose Connect to Serial Ports The list of serial ports includes the port names or administrator-defined aliases only for ports you have permission to access. If the list is empty or does not include a port you need to access, contact the CS system administrator. Port Access Requirements To disconnect from the Java applet Select the left icon to reconnect to the server or device; or select the right icon to end the session and disconnect from the Java applet. When you connect to a serial port to access a server or another device, access rights to the specific serial port on CS is required. Your system administrator can help with authorization to specific CS ports that your server or device is connected to. Note: If an authentication server is setup in your network, an authentication method and the related parameters should be setup to allow access to the connected devices. Consult your system administrator for configuring the authentication method. When you select a port from the Serial pull-down list and click the Connect button, a Java applet viewer appears. A Connected to message in a gray area at the top of the screen shows the IP address of the CS followed by the TCP port number. See an example of the Java applet in Figure 3-4 Connection Protocols for Serial Ports You can access a server or a device connected to a serial port by using the connection protocol specified for the port. There are a number of connection protocols for the serial ports, which your system administrator can setup 54

85 Connect depending on your requirements. The following table shows the protocols the CS administrator can choose for the serial ports. Table 3-3: Serial Ports Connection Protocols Connection Type Console Access Server (CAS) Terminal Server (TS) Dial-up Other Protocol Telnet, SSH, Telnet&SSH, Raw Telnet, SSHv1, SSHv2, Local Terminal, Raw Socket PPP-No Auth., PPP, SLIP, CSLIP Power Management, Bi-directional Telnet TCP Port Numbers for Serial Ports The TCP port numbers by default start at 7001 for serial port 1 and increments up to the number of serial ports that your CS unit has. For example, an CS with 8 serial ports have TCP ports 7001 through The CS administrator may change the default port numbers, so if you use the defaults and they fail, check with the administrator to find which port numbers to use. To Use Telnet to Connect to a Device Through a Serial Port For this procedure, you need the hostname of the CS or its IP address and the TCP port number for the serial port to which the device is connected. To use Telnet in a shell, enter the following command: telnet hostname IP_address TCP_port_number To Close a Telnet Session Enter the Telnet hotkey defined for the client. The default is Ctrl ] and q to quit. BLACK BOX CS Installation, Administration, and User s Guide 55

86 Web Manager for Regular Users To Use SSH to Connect to a Device Through a Serial Port For this procedure, you need the username configured to access the serial port, the TCP port number, and the hostname of the CS or its IP address. To use SSH in a shell, enter the following command: ssh -l username:tcp_port_number CS_IP_address To Close an SSH Session Enter the hotkey defined for the SSH client followed by a dot.. The default is ~. Note: Make sure you enter the escape character followed by a. at the beginning of a line to close the SSH session. IPDU Power Mgmt. IPDU or Intelligent Power Distribution Units management allows you to manage the power outlets on the AlterPath PM products. When you select the IPDU Power Mgmt. option, if you have permission to manage outlets on an AlterPath PM, two tabs appear at the top of the form, as shown in the following figure, Outlets Manager and View IPDUs Info. Figure 3-5: Regular User > IPDU Power Mgmt. Forms You can access the forms under IPDU Power Mgmt. menu to manage outlets, or view IPDUs information: 56

87 IPDU Power Mgmt. Outlets Manager When you go to IPDU Power Mgmt.>Outlets Manager tab, the message shown in the following figure appears if, 1- You do not have permission to manage power on any of the AlterPath PM outlets or, 2- CS cannot detect an AlterPath PM that has been configured for power management. Contact the CS administrator for help, if you see this message. Figure 3-6: Regular User > Outlets Manager (no permissions) The following form appears if you have permission to manage power on one or more outlets of the AlterPath PM. Figure 3-7: Regular User > Outlets Manager (with permissions) BLACK BOX CS Installation, Administration, and User s Guide 57

88 Web Manager for Regular Users The form shows separate entries for each serial port configured for power management, a name for the configured serial port if one is defined by the administrator, and the number of IPDUs connected. The matrix displays a line item for each outlet you are authorized to manage. The authorized user can do the following for any listed outlet: Edit the outlet name. Enter a name to identify the server or device plugged into the outlet. Edit the power up interval. The power up interval is the time interval (in seconds) that the system waits between turning on the currently-selected outlet and the next outlet. The default is set at 30 seconds. Cycle - Turn power briefly off and on again. Turn the power On/Off to the outlet. Lock or unlock the outlet to prevent accidental changes to the power state. The following table describe the corresponding buttons to do the above operations: Button Purpose Opens a dialog box to Edit an Outlet name, and the Power Up Interval. Turn power briefly off and then on again. Turn power On/Off. Lock or unlock the outlet. Table 3-4: Regular User > Outlet Management Buttons 58

89 IPDU Power Mgmt. View IPDUs Info When you go to IPDU Power Mgmt.>View IPDUs Info, the form appears as shown in the following figure. Figure 3-8: Regular User > View IPDUs Info The following information is displayed for each port that is configured for power management. Table 3-5: Regular User > Information on the View IPDUs Info Form Name Number of Units Description Either a default name or administrator-configured name. The number of IPDUs connected to the port. The first IPDU is referred to as the master. Any other IPDUs daisy-chained off the first IPDU are referred to as slaves. Example PM 1 Syslog Buzzer Number of Outlets Whether syslogging has been configured for messages from this IPDU. Whether a buzzer has been configured to sound when a specified alarm threshold is exceeded. Total number of outlets on all connected IPDUs. 8 ON ON BLACK BOX CS Installation, Administration, and User s Guide 59

90 Web Manager for Regular Users Table 3-5: Regular User > Information on the View IPDUs Info Form Over Current Protection Description Whether over current protection is enabled (to prevent outlets from being turned on if the current on the IPDU exceeds the specified threshold). Example OFF Description Example Model AlterPath PM model number PM8 15A Software Version PM firmware version Alarm Threshold Number of amperes that triggers an alarm or syslog message if it is reached 15.0A Current Current level on the IPDU 0.0A Maximum Detected Maximum current detected 0.4A Use this button to refresh the currently displayed maximum detected temperature. Temperature Maximum Detected Temperature on the AlterPath PM (Available only on selected models that have temperature sensors) Maximum temperature detected (Available only on selected models that have temperature sensors) IPDU Multi-Outlet Ctrl Use this button to refresh the currently displayed maximum detected current. Selecting IPDU Multi-Outlet Control form allows you to view and manage the power on a group of outlets that provide power to a multi power supply server or device connected to a serial port. Whether the outlets that the multi 60

91 IPDU Multi-Outlet Ctrl power supply device is connected to are on the same PM or not, the outlets can be grouped together and managed simultaneously from this form. When you select IPDU Multi-Outlet Ctrl form, the following figure appears if, 1. There is no multi-outlet device defined. 2. Power Management is not enabled for the serial port the device is connected to. 3. CS cannot detect an AlterPath PM that has been configured for power management. Contact the CS administrator for help, if you see this message. Figure 3-9: Regular User > IPDU Multi-Outlet (no permissions) The following form appears if you have permission to view and control the outlets that a multi power supply server or device is connected to. BLACK BOX CS Installation, Administration, and User s Guide 61

92 Web Manager for Regular Users Figure 3-10: Regular User > IPDU Multi-Outlet (with permissions) Notice in the above figure that the first line of each group, the light bulb, the lock icon, and the Cycle button operate over the entire group. The light bulb and lock icons next to the individual outlets are used to display the status of each outlet but cannot be used to control the individual outlets. The following table describes the icons in the first line of each group. Table 3-6: Regular User > IPDU Multi-Outlet Ctrl. Form Icons Button Purpose A grey light bulb icon indicates that the group is off. A yellow light bulb indicates that the group is on. Clicking the light bulb icon changes the power status of all of the outlets in the group. A grey and open lock icon indicates that the outlets are unlocked and can be powered on or off. A full-color and closed lock icon indicates that the outlet is locked and cannot be turned on or off. Clicking the lock icon changes the lock status of all of the icons in the group. Turn power briefly off and on again Note: Only one outlet needs to be powered on or unlocked in order for the entire group to be considered on or unlocked respectively. In this case, it takes two clicks to turn the power off or to lock the entire group instead of the one click, when all of the outlets are in the same state. The first click turns the other outlets on or unlocks them so that all the outlets are in the same state; the second click turns all of the outlets off or locks them. The Cycle button operates only if all outlets of a group are turned on. Note: The PU (Power Up) interval" parameter configured for each outlet plays an important role in the power up sequence of multi-outlet devices. The next 62

93 Security outlet in the group turns on only after the power up interval specified for the current outlet has elapsed. This parameter can be configured through the IPDU Power Mgmt. form. See To Close an SSH Session on page 56. Security When you select the Security menu option, the following form appears.. Table 3-7: Regular User > Password Management Form To Change Your Password 1. Select the Security option from the menu panel. The Security form appears. 2. Enter your current password in the Current Password field. 3. Enter the new password in the New Password and the Repeat New Password fields. 4. Click OK. 5. Log out and log in using your new password to verify your password change. BLACK BOX CS Installation, Administration, and User s Guide 63

94 Web Manager for Regular Users 64

95 Chapter 4 Web Manager for Administrators Overview This chapter is for system administrators who use the Web Manager to configure the CS and its users. For information on how to configure CS using vi or Command Line Interface (CLI), please consult the BLACK BOX CS Installation, Administration, and User s Guide. The CS Web Manager for administrators describes two modes of operation, Wizard and Expert. This chapter provides an overview of the Web Manager forms. The subsequent chapters describe the menus, forms, and the configuration procedures of the Web Manager in Wizard and Expert modes. If you are a regular user see Chapter 3, Web Manager for Regular Users. The sections listed in the following table provides background information related to CS administrators use of the Web Manager, including explanations of the types of information to be entered in each of the forms, and links to all the procedures performed in each mode. BLACK BOX Web Manager Page 66 Common Tasks for CS Administrators Page 67 Common Features of Administrators forms Page 68 Logging into the Web Manager Page 70 Overview of Administrative Modes Page 73

96 Web Manager for Administrators BLACK BOX Web Manager CS administrators perform most tasks through the BLACK BOX Web Manager either locally or from a remote location. The Web Manager provides a real-time view of the equipment that is connected to the CS. The CS administrator can use the Web Manager to configure users and ports. An authorized user can access connected devices through the Web Manager to troubleshoot, maintain, recycle power, and reboot connected devices. Access to the Web Manager can be through any of the following methods: Through an Ethernet protocol network. Through a dial-up protocol such as: An optional modem connected to one of the serial ports. An optional modem card inserted into one of the PCMCIA slots. An optional CDMA wireless, GSM, or ISDN card. Prerequisites for Using the Web Manager The prerequisites described in this section must be completed before anyone can access the Web Manager. If you have questions about any of the following prerequisites, contact your system or network administrator. Basic network parameters must be defined on the CS so the Web Manager can be launched over the network. The IP address of the CS must be known. Note: If DHCP is enabled on CS, the IP address is not fixed. Anyone wanting to access the CS must find out the currently-assigned IP address each time. If DHCP is enabled and you do not know how to find out the current IP address of the CS, contact your system administrator for help. A user account must be defined on the Web Manager. By default, the root has an account on the Web Manager. An administrator with root access can add regular user accounts to access connected devices. 66

97 Common Tasks for CS Administrators Common Tasks for CS Administrators Task The following table shows some of the common tasks that are performed by an administrator and links to the process and procedure for performing the task. Table 4-1: Administrator > Common Administrative Tasks Where Documented Set up users and groups to access connected devices. Set up user authentication to access serial ports. Users and Groups on page 208 Access on page 259 Configure serial ports for power management. Assign users permissions to manage outlets on connected AlterPath PMs. Set up local or remote data buffering, and specify alarms for one or more serial ports. Set up logging of system messages to a syslog server. Configure devices for IPMI power management. Select an authentication method for accessing connected devices. To Configure a Power Management Protocol for an IPDU on page 254 To Configure Users to Manage Power Outlets on IPDUs on page 128 To Configure Data Buffering for Serial Ports on page 267 To Choose a Method for Sending Notifications for Serial Port Data Buffering Events on page 297 To Specify Names, Alarms, Syslogging, and Over Current Protection for IPDUs on page 130 To Configure Syslogging for Serial Ports and Specify Message Filtering on page 158 IPMI Power Management on page 139 Authentication on page 214 Configure packet filtering. Firewall Configuration on page 186 BLACK BOX CS Installation, Administration, and User s Guide 67

98 Web Manager for Administrators Common Features of Administrator Forms The common features of all Web Manager forms for CS administrators are described in the following sections. Buttons and CS Information Getting more information Buttons and CS Information The following figure shows the control buttons that display at the bottom of the form when the logged in user is an administrator. Figure 4-1: Administrator > Web Manager Buttons The following table describes the uses for each control button. Table 4-2: Administrator > Web Manager Buttons Button Name back try changes cancel changes apply changes reload page Help next Use Only appears in Wizard mode. Returns the previous form. Tests the changes entered on the current form without saving them. Cancels all unsaved changes. Applies all unsaved changes. Reloads the page. Brings up the online help. Only appears in Wizard mode. Goes to the next form. 68

99 Common Features of Administrator Forms Table 4-2: Administrator > Web Manager Buttons Button Name Use The unsaved changes button appears on the lower right hand corner of the Web Manager and a graphical LED blinks red whenever the current user has made any changes and has not yet saved the changes. The no unsaved changes button appears and a graphical LED appears in green when no changes have been made that need to be saved. The various Web Manager actions for trying, saving, and restoring configuration changes are summarized in the following table. Table 4-3: Administrator > Options for Trying, Saving, and Restoring Configuration Changes Task Action Result try changes cancel changes apply changes Click the try changes button Click the cancel changes button Click the apply changes button Updates the appropriate configuration files. Changes are preserved if you log in and log out, and even if you restart the system. Changes stay in effect unless the cancel changes button is clicked. The changes can be restored at any time until the apply changes button is clicked. Restores the configuration files from the backup that was created the last time changes were applied. If try changes has not been previously clicked, updates the appropriate configuration files. Overwrites the backed up copy of the configuration files. BLACK BOX CS Installation, Administration, and User s Guide 69

100 Web Manager for Administrators The following table illustrates the information that displays in the upper right corner of all Web Manager forms. Table 4-4: Administrator > Logout Button and Other Information in the Upper Right Form Area Purpose Click this button to log out. Displays the hostname, IP address assigned during initial configuration, and the model number of the Advanced Console Server. Logging Into the Web Manager The following procedure describes the login process to the Web Manager, and what should be expected the first time you login to CS. To Log Into the Web Manager 1 To bring up the Web Manager, enter the IP address of the CS in the address field of your browser. For example, Note: Devices such as CS are usually assigned a static IP addresses. If DHCP is enabled, you must find out the dynamically-assigned IP address each time you need to run the Web Manager. Finding a dynamically-assigned IP address requires making an inquiry to the DHCP server using the MAC address (a 12- digit hexadecimal number, which is on a label on CS). Check with the system administrator who configured the basic network parameters on the assigned IP address. If there is no DHCP server, use the default static IP address that is pre-configured in the CS. a. If DHCP is disabled, use a static IP address assigned by the administrator. b. If DHCP is enabled, enter the dynamically-assigned IP address. The Login page appears. 70

101 Logging Into the Web Manager Figure 4-2: Administrator > Web Manager Login Form 2. Log in as root and type in the root password. The default password is bb. Caution: It is important to change the root password as soon as possible to avoid security breaches. If another administrator is already logged in, the dialog box shown in the following screen example appears. BLACK BOX CS Installation, Administration, and User s Guide 71

102 Web Manager for Administrators Figure 4-3: Administrator > Multi Administrator Login Message 3 Click the appropriate radio button and then click Apply. Note: The following Security Advisory appears the first time CS is accessed. Browser s pop-up blocker should be disabled for this dialog box to appear. 72

103 Overview of Administrative Modes Figure 4-4: Administrator > Security Advisory Message Overview of Administrative Modes The CS Web Manager operates in two modes: 1. Wizard 2. Expert In Wizard mode, the Expert button displays. In Expert mode, the Wizard button displays. Clicking these buttons toggles between Wizard and Expert mode. Expert is the default mode. BLACK BOX CS Installation, Administration, and User s Guide 73

104 Web Manager for Administrators Wizard Mode The Wizard mode is designed to simplify the setup and configuration process by guiding the administrator through six configuration steps. When you log in to CS as an administrator or as a user with administrative privileges, by default the system point to Expert Mode>Ports>Ports Status form. To change to the Wizard Mode, click on the Wizard button located in the left bottom corner of the menu panel. Shown below is a typical form of the CS web interface in Wizard Mode. The user entry form varies depending on the selected menu item. Figure 4-5: Example of Web Manager Form in Wizard Mode Expert Mode Designed for advanced users, this is the default mode when you log in to the CS. If you are in the Wizard mode, you can change to Expert mode by clicking on the Expert' button at the left bottom corner of the menu panel. Shown below is a typical CS screen in Expert Mode. The main difference in the interface when you switch between the two modes, is the addition of a top 74

105 Overview of Administrative Modes menu bar in the Expert Mode to support more detailed and customized configuration. In Expert mode the top menu bar contains the primary commands, and the left menu panel contains the secondary commands. Based on what you select from the top menu bar, the left menu selections will change accordingly. Occasionally, an Expert Mode menu selection has multiple forms, which are identified by tabs such as the one shown in Figure 4-6. Figure 4-6: Example of Web Manager Form in Expert Mode The subsequent chapters shown below describe the Wizard and Expert configuration modes in detail, introduces the menu elements in the Expert mode, and describe the underlying procedures. Table 4-5: Administrator > CS Configuration and Expert Menus Chapters Configuring the CS in Wizard Mode Chapter 5 Configuring the CS in Expert Mode Chapter 6 Applications Menu [Expert] Chapter 7 Network Menu [Expert] Chapter 8 BLACK BOX CS Installation, Administration, and User s Guide 75

106 Web Manager for Administrators Table 4-5: Administrator > CS Configuration and Expert Menus Chapters Security Menu [Expert] Chapter 9 Ports Menu [Expert] Chapter 10 Administration Menu [Expert] Chapter 11 76

107 Chapter 5 Configuring CS in Wizard Mode There are six configuration steps displayed in the menu panel of the Web Manager in Wizard mode. The following table lists the sections where the steps are described. Step 1: Security Profile Page 77 Step 2: Network Settings Page 85 Step 3: Port Profile Page 88 Step 4: Access Page 91 Step 5: Data Buffering Page 96 Step 6: System Log Page 101 Step 1: Security Profile A Security Profile consists of a set of parameters that can be configured in order to have more control over the services that are active at any time. Pre-defined Security Profiles There are three pre-defined security profiles: 1. Secure - The Secure profile disables all protocols except SSHv2, HTTPS, and SSH to Serial Ports. Authentication to access Serial Ports is required, and SSH root access is not allowed.

108 Configuring CS in Wizard Mode Note: SSH root access is enabled when the security profile is set to Moderate or Open. If a Secured security profile is selected, you need to switch to a Custom security profile, and enable allow root access option. 2. Moderate - The Moderate profile is the recommended security level. This profile enables SSHv1, SSHv2, HTTP, HTTPS, Telnet, SSH and Raw connections to the Serial Ports. In addition, ICMP and HTTP redirection to HTTPS are enabled. Authentication to access the serial ports is not required. 3. Open - The Open profile enables all services such as Telnet, SSHv1, SSHv2, HTTP, HTTPS, SNMP, RPC, ICMP, and Telnet, SSH and Raw connections to the Serial Ports. Authentication to access serial ports is not required. Default Security Profile The Default Security Profile sets the parameters to same as Moderate profile. See the following tables for the list of enabled services when the Default security profile is used. Custom Security Profile The Custom Security Profile opens up a dialog box to allow custom configuration of individual protocols or services. Note: By default, a number of protocols and services are enabled in the Custom profile, however, they are configurable to user s custom requirements The following tables illustrate the properties for each of the Security Profiles. The enabled services in each profile is designated with a check mark. 78

109 Table 5-1: Wizard > Enabled services to access the CS under each security profile. Access to CS Secure Moderate Open Default 1 Custom Telnet SSHv1 SSHv2 Allow SSH root access HTTP HTTPS User Configurable HTTP redirection to HTTPS 1-The Default security profile parameters are the same as Moderate profile. Table 5-2: Wizard > Enabled services to access the serial ports under each security profile. Access to Serial Ports Secure Moderate Open Default 1 Custom Console (Telnet) Console (SSH) Console (Raw) Serial Port Authentication Bidirect (Dynamic Mode Support) User Configurable 1-The Default security profile parameters are the same as Moderate profile. BLACK BOX CS Installation, Administration, and User s Guide 79

110 Configuring CS in Wizard Mode Table 5-3: Wizard > Enabled protocols for each security profile shown with a check mark. Other Services Secure Moderate Open Default 1 Custom SNMP RPC ICMP FTP IPSec User Configurable 1-The Default security profile parameters are the same as Moderate profile. The first step in configuring your Advanced Console Server is to select a Security Profile. One of the following situations is applicable when you boot the CS unit. 1. CS is starting for the first time, or after a reset to factory default. In this situation when you boot CS and login as an administrator to the Web Manager, a security warning dialog box appears. The Web Manager is redirected to Step1: Security Profile in the Wizard mode. Further navigation to other sections of the Web Manager is not possible without selecting or configuring a Security Profile. Once you select or configure a Security Profile and apply the changes, CS Web Manager restarts for the security configuration to take effect. 2. CS firmware is upgraded and the system is restarting with the new firmware. In this situation the CS was already in use and certain configuration parameters were saved in the flash memory. In this case CS automatically retrieves the Custom Security Profile parameters saved in the flash memory and behaves as it was a normal reboot. 3. CS is restarting normally. In this situation CS detects the pre-defined security profile. You can continue working in the Web Manager. 80

111 Serial Port Settings and Security Profiles All serial ports on CS units shipped from the factory are disabled by default. The administrator can enable ports individually or collectively and assign specific users to individual ports. The following figure shows the default factory settings of serial ports. Figure 5-1: Administrator > Physical Ports Factory Settings If you reconfigure the Security Profile and restart the Web manager, you need to make sure the serial ports protocols and access methods match the selected security profile. The following reminder dialog box appears before you proceed to Step2: Network Setting. Figure 5-2: Security and Serial Ports Configuration Alert BLACK BOX CS Installation, Administration, and User s Guide 81

112 Configuring CS in Wizard Mode To Select or Configure a Security Profile The following procedure assumes you have installed a new CS at your site, or you have reset the unit to factory default. 1. Enter the assigned IP address of the CS in your browser and login as an administrator. The following security warning dialog box appears. Figure 5-3: Security Advisory Dialog Box 82

113 Note: Your browser s pop-up blocker should be disabled for this dialog box to appear. 2. Review the Security Advisory and click the Close button. 3. The Web Manager is redirected to Wizard > Step 1: Security Profile. The following form is displayed. Figure 5-4: Wizard > Step 1: Security Profile Form 4. Select a pre-defined Security Profile by pressing one of the Secured, Moderate, Open, or Default profiles, or create a Custom profile. The following dialog box appears when you select the Custom profile. BLACK BOX CS Installation, Administration, and User s Guide 83

114 Configuring CS in Wizard Mode Figure 5-5: Custom Security Profile Dialog Box Caution: Take the required precautions to understand the potential impacts of each individual service configured under the "Custom" profile Refer to Table 5-1 on page 79, and the subsequent tables for a comparison of the available services in each security profile. Refer to the Glossary for a definition of the available services. 84

115 Note: It is not possible to continue working in the Web Manager without selecting a Security Profile. The following dialog box appears if you try to navigate to other sections of the Web Manager. 5. Once you select a security profile or configure a custom profile and apply the changes, the CS Web Manager restarts in order for the changes to take effect. The following dialog box appears. 6. Select apply changes to save the configuration to Flash. CS Web Manager restarts. 7. Login after Web Manager restarts and click on the Wizard button to switch to Wizard mode. 8. Proceed to Step 2: Network Settings. Step 2: Network Settings Selecting "Step 2: Network Settings brings up a form for reconfiguring existing network settings. During initial setup of the CS, the administrator configures the basic network settings that were required to enable logins through the Web Manager. You can skip this step if the current settings are correct. BLACK BOX CS Installation, Administration, and User s Guide 85

116 Configuring CS in Wizard Mode In preparation to configure network settings collect the following information and proceed with the network configuration procedure. Hostname An IP address for CS Domain name DNS server s IP address Gateway IP address Network mask NTP server s IP address (if you are using a time/date server) In Expert mode, under Network menu, you can specify additional networkingrelated information and perform other advanced configuration tasks. If the DHCP is disabled, the form appears as shown in the following figure. Figure 5-6: Wizard > Step 2: Network Settings - DHCP disabled. If the DHCP is enabled, the form appears as shown in the following figure. 86

117 Figure 5-7: Wizard > Step 2: Network Settings - DHCP enabled. To configure the Network Settings 1. Select Step 2: Network Settings. The system brings up the DHCP form. By default DHCP is active. Note: If DHCP is enabled, a local DHCP server assigns CS a dynamic IP address that can change. The administrator chooses whether or not to use DHCP during initial setup. 2. If you are using DHCP, proceed to Step 3: Port Profile, if not, click on the checkbox to deselect DHCP and enter your network settings manually. 3. Enter the following network information: Host Name IP addresses Network Mask Domain Name DNS Server Gateway IP 4. Select apply changes to save configuration to flash. BLACK BOX CS Installation, Administration, and User s Guide 87

118 Configuring CS in Wizard Mode 5. Select the Next button, or proceed to Step 3: Port Profile. Step 3: Port Profile Selecting Step 3: Port Profile brings up a form for configuring the Console Access Profile (CAS). The protocol used to access the serial ports can be configured in this form. Figure 5-8: Wizard > Step 3: Port Profile In Wizard mode the system assumes that all devices will be connected to the serial ports with the same parameter values. If you need to assign different parameters to the serial ports that each server or device is connected to, use the Expert mode, Ports > Physical Ports to assign individual port parameters. Note: From the factory by default, all Serial Ports are disabled. The administrator can enable ports and assign specific users to individual ports through the Expert mode. 88

119 The following table lists the parameters with the available options and a brief description for each. Table 5-4: Wizard > Serial Port Profile Parameters and Usage Parameter Options Description Connection Protocol Flow Control Parity Baud Rate (Kbps) Data Size Stop Bits Console (Telnet) [Default] Console (SSH) Console (TelnetSSH) Console (Raw) None [Default] Hardware Software None [Default] Odd Even 9600 [Default] Options range from Kbps 8 [Default] Options range from [Default] Options are either 1 or 2 Sets the protocol to be used to connect to devices that are connected to serial ports. Console (SSH) encrypts data and authentication information. Console (TelnetSSH) allows users to connect using either protocol. Console (Raw) is for unnegotiated plain socket connections. Use Expert mode if you want to specify any of several other connection protocols that are listed under Ports>Physical Ports>Modify>General. Must match the flow control method of the devices connected to all serial ports. Must match the parity used by the devices connected to all serial ports. Must match the baud rates of the devices connected to all serial ports. Must match the number of data bits used by the devices connected to all ports. Must match the number of stop bits used by the devices connected to all ports. BLACK BOX CS Installation, Administration, and User s Guide 89

120 Configuring CS in Wizard Mode Table 5-4: Wizard > Serial Port Profile Parameters and Usage (Continued) Parameter Options Description Authentication Required Check for enabled. Unchecked for disabled. [Default] If the Authentication Required is enabled, user authentication is enforced using the local passwd database. To specify other authentication methods such as RADIUS, TACACS+, LDAP, Kerberos, or NIS go to Expert mode and select Security>Authentication. Expert mode provides additional options for custom configuration of serial ports. For example, to assign an alias to a serial port, to specify individual parameters to the serial ports or groups of serial ports, or to utilize any of several other connection protocols. For information on configuring serial ports in expert mode see Chapter 10, Ports Menu & Forms. To Set Parameters for All Serial Ports This step configures all serial ports with the same values. Use this form if all the devices connected to the serial ports on CS can run using the same connection protocol with the same speed. In addition you need to make sure the values you specify here are the same as those in effect on the connected devices. If the connected devices require different connection protocols and speed, configure individual settings in Expert mode > Ports > Physical Ports. See Chapter 10, Ports Menu & Forms for more detail. 1. Select a protocol, Console (Telnet), Console (SSH) Console (TelnetSSH), or Console (Raw) from the Connection Protocol pull-down menu. The default is Console (Telnet). 2. To change the flow control, select None, Hardware, or Software from the Flow Control pull-down menu. The default is None. 90

121 3. To change the parity, select None, Odd or Even from the Parity pull-down menu. The default is None. 4. To change the baud rate, select an option from 2400 to Kbps from the Baud Rate pull-down menu. The default is 9600, which is the most common baud rate for devices. 5. To change the data size, select an option from 5 to 8 from the Data Size pull-down menu. The default is To change the stop bits, select 1 or 2 from the Stop Bits pull-down menu. The default is To change whether authentication is required, check the Authentication Required checkbox for enabled or leave it unchecked for disabled. 8. Select apply changes' to save configuration to Flash. 9. Select the Next button or proceed to the next section, Step 4: Access. Step 4: Access Selecting Step 4: Access brings up a form shown in the following figure, which allows you to add or delete user accounts, and set or change existing passwords. In addition, administrative privileges can be granted to added users by adding the user accounts to an admin group, enabling them to administer the connected devices without the ability to change the configuration of the CS. By default any user can access any port as long as they have a valid user ID and password. BLACK BOX CS Installation, Administration, and User s Guide 91

122 Configuring CS in Wizard Mode Figure 5-9: Wizard > Step 4:Access The Access form lists the currently defined Users and has Add, Change Password, and Delete buttons. In the Users list by default, there is a root account that cannot be deleted. The root has access privileges to all the Web Manager s functionality as well as access to all the serial ports on the CS. Clicking the Add button, brings up the following form. 92

123 Figure 5-10:Wizard > Step 4: Access Add User Dialog Box The following table defines the information required in the fields. Table 5-5: Wizard > Add User Dialog: Field Names and Definitions Field Name User Name Password and Repeat Password Group [dropdown list] Definition The username for the account being added. The password for the account. The choices in the Group menu are Regular User [Default] or Admin. Note: To configure a user to be able to perform administrative functions, select the Admin group. To define a new group, go to the Expert mode and select Security > Users and Groups. Select whether the user of this group is a NonBio [Default] or a BioUser. The BioUser group should only be selected if authentication will be made through the AlterPath Bio (biometric authentication). BLACK BOX CS Installation, Administration, and User s Guide 93

124 Configuring CS in Wizard Mode Table 5-5: Wizard > Add User Dialog: Field Names and Definitions Field Name Shell Comments Definition Optional. The default shell when the user makes an SSH or a Telnet connection. Choices are: sh [Default] or bash. Optional notes about the user s role or configuration. If you click the Change Password button, the following dialog box appears. Figure 5-11:Wizard > Step 4: Change Password Dialog Box To Add a User 1. Select Step 3: Access The Access form displays. 1. Click Add. The Add User dialog box appears. 2. Enter the username and password in the User Name and Password fields, and enter the password again in the Repeat Password field. 3. Select from the Group menu options. a. To create a regular user account without administrator privileges, select Regular User [Default] from the Group pull-down menu. 94

125 b. To create an account with administrator privileges, select Admin from the Group pull-down menus. Note: To define a new group, switch to Expert mode, and select Security > Users and Groups. 4. Select whether the user of this group is a NonBio or a BioUser. The BioUser group should only be selected if authentication is made through the AlterPath Bio (biometric authentication). 5. Enter the default shell in the Shell field (optional). 6. Enter comments to identify the user s role or configuration in the Comments field (optional). 7. Click OK. 8. Click the apply changes button. To Delete a User 1. Select Step 3: Access. The Access form displays. 2. Select the user name to delete. 3. Click Delete. 4. Click apply changes. To Change a Password Caution: Leaving the default root password unchanged leaves the CS and connected devices open to anyone who knows the default password and the CS s IP address. For security reasons, change the root password from the default bb as soon as possible. 1. Select Step 3: Access. The Access form displays. 2. Select the name of the user whose password you want to change. BLACK BOX CS Installation, Administration, and User s Guide 95

126 Configuring CS in Wizard Mode 3. Click Change Password. The Change User Password dialog box displays. 4. Enter the new password in both fields, and click OK. 5. Click apply changes. Step 5: Data Buffering Selecting Step 5: Data Buffering brings up a form to allow logging the console data to a data buffer file either locally in CS or remotely to an external storage source such as an NFS server or Syslog server. The following figure shows the form when Enable Data Buffering is inactive. Figure 5-12:Wizard > Step 5: Data Buffering [Inactive] Once data buffering is enabled the form displays a number of fields. The displayed fields depends on whether selected Destination is Local or Remote. The values set in this form apply to all serial ports. Data buffering allows a site to save a record of all communication during a serial port connection session. You can set up data buffer files to be stored either in local files on the 96

127 CS s flash memory or on the hard disk of an external server, such as an NFS or Syslog server. The following figure shows the form when Data Buffering is set to enabled, and the Destination is set to Local. Figure 5-13:Wizard > Step 5: Data Buffering [Local] The following figure shows the form when data buffering is set to Destination Remote BLACK BOX CS Installation, Administration, and User s Guide 97

128 Configuring CS in Wizard Mode Figure 5-14:Wizard > Step 5: Data Buffering [Remote] The following table provides description for each field whether local or remote destination is selected. Table 5-6: Wizard > Data Buffering Field Names and Definitions Field Name Destination Mode Definition Where the buffer files should be stored. Local, for example, flash, or Remote on a server. For Local Destination - Select Linear for sequential files, or Circular for non-sequential format. Local data buffering stores data in circular or linear mode. In circular mode, data is written into the specified local data file until the upper limit on the file size is reached; then the data is overwritten starting from the top of the file as additional data comes in. Circular buffering requires the administrator to set up processes to examine the data during the timeframe before the data is overwritten by new data. 98

129 Field Name File Size (Bytes) Record the timestamp... NFS File Path Show Menu Definition For Local Destination - Sets the value for this field to be greater than zero. If enabled, the system inserts a timestamp in the buffer. For Remote Destination - Includes the path where the data buffer file should be stored. Defines the options you want to show in the menu of the buffer file. Note: Make sure that enough disk space is available to store the files in the location you select. Sequentially-written files can quickly grow to exceed the storage capacity of the local flash memory or remote hard drive. Data buffering should only be done if processes are in place to monitor the stored data. The following table shows the differences between remote and local data buffering. Table 5-7: Wizard > Differences Between Remote and Local Buffering Option Remote server Local files Description Data is stored in files sequentially. The NFS server must be configured with the mount point shared (exported). In linear mode, data is written into a continuous sequence of files, and the file spaces is not reused. The administrator needs to allow enough space for the expected amount of data, and take measures such as moving unneeded data files off line, to ensure data does not outgrow the available space. Set a file size greater than zero. Make sure the file size does not exceed the space available on the CS s flash memory. If needed, you can supplement the flash memory module by installing a flash memory card (with an adapter) or other storage device in a PCMCIA slot. For a list of supported PCMCIA cards see Appendix C. BLACK BOX CS Installation, Administration, and User s Guide 99

130 Configuring CS in Wizard Mode Note: You can perform advanced configuration in Expert mode including the option of setting up data buffering separately for individual or groups of serial ports. To Configure Data Buffering 1. Select Step 4: Data Buffering 2. Click the Enable Data Buffering checkbox. The Destination pull-down menu appears. 3. Select a location for the data files from the Destination pull-down menu (either Local or Remote ). Additional pull-down menus and fields appear, depending on which destination is selected. 4. When the destination is local, perform the following steps. a. From the Mode pull-down menu, select Circular or Linear data buffering. b. Type a file size in bytes into the File Size (Bytes) field. The file size should be greater than zero. 5. When the destination is remote, perform the following steps. 100

131 a. In the NFS File Path field, enter the pathname for the mount point of the directory where data buffer file is to be stored. For example, if the mount point directory s pathname is /var/adm/ cslogs, enter /var/adm/cslogs in the field. Note: The NFS server must already be configured with the mount point shared (exported), and the shared directory from the NFS server must be mounted on the CS. b. To cause a timestamp to be saved with the data in the data buffer file, enable the Record the timestamp in the data buffering file. c. Select an option from the Show Menu pull-down menu. The choices are: show all options, No, Show data buffering file only, and Show without the erase options. 6. Click apply changes. Step 6: System Log Selecting Step 6: System Log brings up a form for identifying one or more syslog servers to receive syslog messages generated by the CS serial ports. Syslogging for IPDUs is also possible, if IPDU power management is configured. See Chapter 7, IPDU Power Mgmt. BLACK BOX CS Installation, Administration, and User s Guide 101

132 Configuring CS in Wizard Mode The form appears as shown in the following figure. Figure 5-15:Wizard > Step 6: System Log Note: To configure syslog with data buffering features for specific ports, switch to the Expert Mode, Ports > Physical Ports > Modify Selected Ports > Data Buffering. Before setting up syslogging, make sure an pre-configured syslog server is available on the same network as the CS. Obtain the following information from the syslog server s administrator. The IP address of the syslog server. The facility number for messages coming from the CS. See Chapter 1, Syslog Servers on how facility numbers are used. To Add a Syslog Server This procedure assumes you have the following information: The IP address of the syslog server The facility number for messages coming from the CS 1. Select Step 6: System Log. 102

133 The System Log form displays. 2. From the Facility Number drop-down menu, select the facility number. 3. In the New Syslog Server field, enter the IP address of a syslog server, and then click the Add button. (Repeat this step until all syslog servers are listed.) 4. The new server(s) appear in the Syslog Servers list. 5. Click apply changes. To Delete a Syslog Server 1. From the Syslog Server list, select the syslog server that you want to delete from the current facility location, and then select Delete. 2. Click apply changes. The subsequent chapters shown below describe the Expert configuration mode in detail, introduces the menu elements in the Expert mode, and describe the underlying procedures. Table 5-8: CS Configuration and Expert Menus Chapters Configuring the CS in Expert Mode Chapter 6, Configuring the CS in Expert Mode Applications Menu [Expert] Chapter 7, Applications Menu & Forms BLACK BOX CS Installation, Administration, and User s Guide 103

134 Configuring CS in Wizard Mode Table 5-8: CS Configuration and Expert Menus Chapters Network Menu [Expert] Security Menu [Expert] Ports Menu [Expert] Administration Menu [Expert] Chapter 8, Network Menu & Forms Chapter 9, Security Menu & Forms Chapter 10, Ports Menu & Forms Chapter 11, Administration Menu & Forms 104

135 Chapter 6 Configuring the CS in Expert Mode This chapter provides an overview of configuring the CS Web Manager in Expert Mode. The following chapters in this manual introduces the Expert mode forms and functionality. The Expert mode is designed for the advanced user administrator who needs to configure the CS beyond the capabilities of the basic wizard mode. This chapter includes the following sections:. Overview of Menus and Forms Page 105 Mapping of the Expert Mode Menus and Form Page 107 A Description on Forms and a Reference to Where the Details are Documented. Page 108 Overview of Menus and Forms If you are in Wizard mode and need to perform advanced configuration, click the Expert button at the bottom of the left menu panel to switch to Expert mode. If the Wizard button displays at the lower left of the screen, you are in Expert mode. The top menu bar contains the primary commands, and the left menu panel contains the secondary commands. Based on what you select from the top menu bar, the left menu panel selections change accordingly. Occasionally, a menu selection comprise of multiple forms as shown in the following figure.

136 Configuring the CS in Expert Mode These forms are identified by their tabs. Select the tab to access the desired form. Top Menu Left Menu Tabs Form Area Wizard/Expert Command buttons Figure 6-1: Expert Mode Screen Elements Note: Procedures in this manual use shortcuts to tell how to get to Web Manager forms. For example, a step telling the user to access the Outlets Manager form use this convention, In Expert mode, go to Applications> IPDU Power Mgmt.>Outlets Manager 106

137 Mapping of the Expert Mode Menus and Forms Mapping of the Expert Mode Menus and Forms The following table illustrates a mapping of the menus and forms available in Expert mode. If you are viewing this document online, click any term to go to the section where the form is described. Table 6-1: Expert Mode Menu and Forms Applications Network Security Connect IPDU Power Mgmt. Outlets Manager View IPDUs Info Users Manager Configuration Software Upgrade [for the AlterPath PM] IPDU Power Mgmt. IPMI Power Management Terminal Profile Menu Ports Physical Ports Modify Selected/All Ports General Access Data Buffering Multi User Power Management Other Virtual Ports Ports Status Ports Statistics Host Settings Syslog PCMCIA Management VPN Connections SNMP Firewall Configuration Host Table Static Routes Administration System Information Notifications Time/Date Boot Configuration Backup Configuration Upgrade Firmware Reboot Online Help Users and Groups Active Ports Sessions Authentication Auth Type Radius Tacacs+ Ldap Kerberos NIS Security Profiles BLACK BOX CS Installation, Administration, and User s Guide 107

138 Configuring the CS in Expert Mode Description of Forms in Expert Mode The following table briefly describes the functionality of each menu and the related forms. For detailed procedures refer to the page where documented for each section. Table 6-2: Expert > Applications Form Use This Form To: Where Documented Connect IPDU Power Mgmt. IPDU Multi-Outlet Ctrl IPMI Power Mgmt. Terminal Profile Menu Connect to the CS shell through a secure SSH session, or connect to a specific serial port. Manage power outlets on the AlterPath PM family of Intelligent Power Distribution Units. From here you may power remote machines on and off, check the status and lock the power outlet in the on or off state to prevent accidental changes. Manage all power outlets of a multi-outlet device connected to the AlterPath PM family of Intelligent Power Distribution Units in one single operation. Manage IPMI devices. Power on and off remote machines, and check their current status. Configure a menu of commands that will be presented to the user when they power on their computer terminal and login to the CS. This is a special application used only when the CS is being used as a server with terminals attached. Chapter 7, Page 116 Chapter 7, Page 120 Chapter 7, Page 133 Chapter 7, Page 139 Chapter 7, Page

139 Description of Forms in Expert Mode Table 6-3: Expert > Network Menu Selection Use this menu to: Where Documented Host Settings Syslog PCMCIA Management VPN Connections SNMP Firewall Configuration Host Table Configure host connections, including: Ethernet Port connections, DNS Service, and Name Service Access. Configure how CS will handle its syslog messages. CS generates syslog messages related to users connecting to ports, login failures and other information that can be used for audit and control purposes. Configure the optional PCMCIA cards. BLACK BOX CS supports several PCMCIA cards including modem, ISDN, wireless and wired NICs, Compact Flash and IDE drives for data buffer storage. Configure one or more VPN connections to other systems or CS attached devices. Configure Simple Network Management Protocol (SNMP) with community names, OID and user names. SNMPv1, v2 and v3 are supported. This section and the dialog boxes guide you to configure the required parameters. Configure static IP tables, and how packets should be filtered. View information about the local network environment. View table of hosts; create, edit, and delete hosts. Chapter 8, Page 152 Chapter 8, Page 157 Chapter 8, Page 158 Chapter 8, Page 176 Chapter 8, Page 181 Chapter 8, Page 186 Chapter 8, Page 201 BLACK BOX CS Installation, Administration, and User s Guide 109

140 Configuring the CS in Expert Mode Table 6-3: Expert > Network Menu Selection Use this menu to: Where Documented Static Routes To manually add routes. Static routes are a very quick and effective way to route data from one subnet to different subnets. Chapter 8, Page 202 Table 6-4: Expert > Security Menu Selection Use this menu to: Where Documented Users and Groups Active Port Sessions Authentication Security Profiles Table 6-5: Expert > Ports Create or edit users and groups, establish or change their passwords, access rights and privileges. Show the active sessions, as well as their identifications, features and usage statistics. Enter the authentication method used to access CS. Select a pre-defined Security Profile, or choose Custom Profile to configure individual settings. Chapter 9, Page 208 Chapter 9, Page 212 Chapter 9, Page 214 Chapter 9, Page 226 Menu Selection Use this menu to: Where Documented Physical Ports Activates or deactivates serial ports. Set the parameters for each or all ports. Configure specific parameters for the serial ports where IPDU devices are connected. Chapter 10, Page

141 Description of Forms in Expert Mode Table 6-5: Expert > Ports Menu Selection Use this menu to: Where Documented Virtual Ports Port Status Ports Statistics Perform Clustering. One CS can be used as a Master to control other CS (slaves) units. All ports of the slave unit appear as if they are in the master unit. This section shows how to define and configure the slaves. View the current status of each port. The information provided here are: RS232 Signal Status and user connected to each port. View information on the data reception Rx bytes and transmission Tx bytes on each physical port. View current CAS user(s), Baud rate, frame, parity, break and overruns. Chapter 10, Page 281 Chapter 10, Page 287 Chapter 10, Page 288 Table 6-6: Administration Menu Selection Use this menu to: Where Documented System Information Notifications View information on the system hardware, version, file system and PCMCIA cards loaded Configure the alarm strings and the destination of the notification. CS can send notification by , pager or SNMP trap in the occurrence of any system warnings and alarms. Chapter 11, Page 292 Chapter 11, Page 295 BLACK BOX CS Installation, Administration, and User s Guide 111

142 Configuring the CS in Expert Mode Table 6-6: Administration Menu Selection Use this menu to: Where Documented Time/Date Boot Configuration Backup Configuration Set the timezone and configure the system s Date and Time. Network Time Protocol (NTP) can also be used. Configure CS to boot from its internal firmware or from the network. Defines the settings for loading the operating system in the event that the CS fails to boot successfully. The BLACK BOX CS can boot from its internal firmware or from the network. This section configures the required parameters. Use a FTP server to save and retrieve your CS configuration; use a storage device to store your configuration. Chapter 11, Page 305 Chapter 11, Page 307 Chapter 11, Page 310 Upgrade Firmware Upload/upgrade new firmware. Chapter 11, Page 313 Reboot Reboot the CS system. Chapter 11, Page 316 Online Help Configure a path to a local server for storing the online help files. Chapter 11, Page

143 Description of Forms in Expert Mode BLACK BOX CS Installation, Administration, and User s Guide 113

144 Configuring the CS in Expert Mode 114

145 Chapter 7 Applications Menu & Forms This Chapter describes the Applications menu and the related forms. The following table provides a description of the left menu panel and links to the detailed information and procedures. Table 7-1: Expert > Applications Menu Menu Selection Use this menu to: Where Documented Connect IPDU Power Mgmt. IPDU Multi-Outlet Ctrl IPMI Power Mgmt. Connect to the CS shell via a secure SSH session or connect to the serial ports. Manage power outlets on the AlterPath PM family of Intelligent Power Distribution Units. From here you may power remote machines on and off, check the status, and lock the power outlet in the on or off state to prevent accidental changes. Manage all power outlets of a multi-outlet server or device connected to the AlterPath PM in one single operation. Manage IPMI (Intelligent Platform Management Interface) devices. Power on/off remote machines and check their current status. Page 116 Page 120 Page 133 Page 139

146 Applications Menu & Forms Table 7-1: Expert > Applications Menu Menu Selection Use this menu to: Where Documented Terminal Profile Menu Configure a menu of commands that will be presented to the user when they power on their computer terminal and login to the CS. This is a special application used only when the CS is being used as server with terminals attached. Page 146 Applications Under Applications in Expert mode, five options appear in the left menu panel as shown in the following figure. Connect Figure 7-1: Expert > Applications Menu Options Selecting the Connect form under Applications brings up the form shown in the following figure. 116

147 Applications Figure 7-2: Expert > Applications > Connect Form Using the Connect form, you can connect directly to CS, or to the devices that are connected to the serial ports. Connect to CS Clicking the Connect to CS radio button and clicking the Connect button, brings up a Java applet running an SSH session similar to the following figure. BLACK BOX CS Installation, Administration, and User s Guide 117

148 Applications Menu & Forms Figure 7-3: Expert > SSH session Java Applet Note: SSH root access is enabled when the security profile is set to Moderate or Open. If a Secured security profile is selected, you need to switch to a Custom security profile, and enable allow root access option. For more information see Chapter 9, Security Menu & Forms. Serial The Serial pull-down menu lists all the serial port numbers or the administrator-assigned aliases that a user is authorized to access. Selecting a port number or alias and clicking Connect brings up a Java applet with a connection protocol that the serial port is configured for. For example, if the serial port is named PM and configured for power management, when you press the Connect button a form similar to the following figure appears. 118

149 Applications Figure 7-4: Expert > Serial Port Java Applet Note the difference between Connect to CS and Serial connections in the Connected to grey bar circled in red in the above two figures. If authentication is in effect for the port, you need to supply a username and password to log into the device. To Connect to the CS This procedure logs you into the CS as a Regular User in a SSH session. 1. Go to Applications > Connect in Expert mode. 2. Click the Connect to CS radio button. 3. Click the Connect button. BLACK BOX CS Installation, Administration, and User s Guide 119

150 Applications Menu & Forms A Java applet viewer appears. If your security profile is set to Moderate or Open you receive a root prompt, otherwise, an authentication form appears. You cannot authenticate unless you change the security profile to Custom and enable allow root access. To Connect to a Device Through a Serial Port 1. Go to Applications > Connect in Expert mode. 2. Click the Serial radio button. 3. Select a port number or alias from the Serial pull-down menu. 4. Click Connect. A Java applet viewer appears. If authentication is specified for the selected port you are prompted to log in. If not, you are automatically logged in. IPDU Power Mgmt. Selecting the IPDU Power Mgmt. brings up the five tabs shown in the following figure. Using the IPDU power management forms you can manage the power to the connected devices only if a serial port is configured for power management. Figure 7-5: Expert > IPDU Power Mgmt. Tab Options For the procedure, see To Configure a Serial Port for IPDU or IPMI Power Management on page

151 Applications The following table provides links to description and procedures for the forms of the IPDU Power Mgmt. tabs. Outlets Manager Page 121 View IPDUs Info Page 124 Users Manager Page 127 Configuration Page 129 Software Upgrade [for AlterPath PM] Page 131 Outlets Manager On the Outlets Manager form under Applications>IPDU Power Mgmt., you can do the following tasks for all outlets on all connected IPDUs. Check the status of outlets Turn outlets on and off Cycle (Briefly switching the outlet off and on) Lock outlets in the on or off state to prevent accidental changes Unlock the outlets Assign an alias to the outlet (to identify the device for which it provides power) Change the power up interval. The power up interval is the time interval (in seconds) that the system waits between turning on the currentlyselected outlet and the next outlet. Save the current configuration to Flash memory. The following figure shows an Outlets Manager form. BLACK BOX CS Installation, Administration, and User s Guide 121

152 Applications Menu & Forms Figure 7-6: Expert > Applications > IPDU Power Mgmt. > Outlets Manager The following table illustrates what each icon indicates Table 7-2: Expert > Outlets Manager Icons Description Button Purpose Yellow bulbs indicate an outlet is switched on.gray indicates an outlet is switched off. An opened padlock indicates that an outlet is unlocked. A closed padlock indicates that an outlet is locked. An orange Cycle button is active next to each outlet that is on. In the example below, outlet 1 is switched on and locked and outlet 2 is switched off and unlocked. 122

153 Applications Figure 7-7: Expert > Outlets Manager Icons Clicking the Edit button brings up the following dialog box. Figure 7-8: Expert > Edit Outlets Dialog Box You can specify a name for the outlet, for example, the server or device name, and change the power up interval. Note: The power up interval is the amount of time (in seconds) that elapses after the selected outlet is turned on before another outlet can be turned on. To View Status, Lock, Unlock, Rename, or Cycle Power Outlets 1. Go to Applications > IPDU Power Mgmt. > Outlets Manager The Outlets Manager form appears. 2. To switch an outlet on or off, click the adjacent light bulb. 3. To lock or unlock an outlet, click the adjacent padlock. BLACK BOX CS Installation, Administration, and User s Guide 123

154 Applications Menu & Forms 4. To momentarily power an outlet off and then on again, click the adjacent Cycle button. 5. To change the outlet s name or the power up interval, click the adjacent Edit button. The Edit Outlet dialog box appears. a. To change the name assigned to the outlet, enter a new name in the Outlet Name field. b. To change the time between when this outlet is turned on and another can be turned on, change the default 0.50 number of seconds in the Power Up Interval field. 6. Click OK. 7. Click the Save Outlets State button. 8. Click apply changes. View IPDUs Info Selecting Applications > IPDU Power Mgmt. > View IPDUs Info tab, the form in the following figure appears. Figure 7-9: IPDU Power Mgmt. > View IPDUs Info The figure shows the information displayed when two eight-outlet AlterPath PM model PM8 15A is cascaded through Serial Port 1. The IPDU is 124

155 Applications configured for syslogging, an alarm buzzer, and over current protection. The configuration is done through the IPDU Power Mgmt Configuration form. The following table describes the information viewable on the View IPDUs Info form. The information shown in the table appears for each serial port that is configured for power management. For example, Figure 7-9 displays Serial Port 1: General Information configured for power management. Table 7-3: Expert > View IPDUs General Information Description Example Name Number of Units Number of Outlets Buzzer Syslog Over Current Protection Either a default name or administratorconfigured name appears. The number of IPDUs connected to the port. The first IPDU is referred to as the master. Any other IPDUs daisy-chained off the first IPDU are referred to as slaves. Total number of outlets on all connected IPDUs. Whether a buzzer has been configured to sound when a specified alarm threshold has reached. Whether syslogging has been configured for messages from this IPDU. Whether over current protection is enabled. Over Current Protection is to prevent outlets from being turned on, if the current on the IPDU exceeds the specified threshold. PM 2 IPDUs daisy-chained through the Serial Port 1 Sixteen for two AlterPath PM8 15A daisy-chained through Serial Port 1 ON when the buzzer is configured ON when syslogging is configured OFF when over current protection is not enabled You can view the following information about each IPDU that is configured through a serial port. For example, the configuration illustrated in Figure 7-9 there are two sets of data. Master Unit Information and Slave 1 Information. There are two PM8 15A IPDUs are daisy-chained through Serial Port 1. BLACK BOX CS Installation, Administration, and User s Guide 125

156 Applications Menu & Forms Table 7-4: Expert > View IPDUs Unit Information Description Example Model AlterPath PM model number PM8 15A Software Version AlterPath PM firmware version Alarm Threshold Number of amperes that triggers an alarm or syslog message if it is reached 15.0A Current Current level on the IPDU 0.0A Maximum Detected Maximum current detected 0.4A Button to reset the maximum detected current value. Temperature Maximum Detected Temperature on the IPDU (Displayed if equipped with a temperature sensor.) Maximum temperature detected on the IPDU Button to reset the maximum detected temperature value. N/A N/A To View and Reset IPDU Information 1. Go to Applications > IPDU Power Mgmt. >View IPDUs Info. The View IPDUs Info form appears. 2. To clear the stored values for the maximum detected current, select the Clear Max Detected Current button. 3. To clear the stored values for the maximum detected temperature, click the Clear Max Detected Temperature button. 126

157 Applications Users Manager On the Users Manager form under Applications > IPDU Power Mgmt., you can assign users to outlets. The following figure shows the form with two users listed for a dual AlterPath PM. The AlterPath PM is connected to serial port 1, which is configured for power management. Figure 7-10: IPDU Power Mgmt> Users Manager If more than one serial port is configured for power management, multiple users lists appear, one for each IPDU power management port. Clicking Add brings up the following dialog box where you can specify one or more comma-separated user names and one or more outlets. Figure 7-11:Expert > IPDU Power Mgmt. > Users Manager > Add User BLACK BOX CS Installation, Administration, and User s Guide 127

158 Applications Menu & Forms When a user is added, their name is added to the list on the Users Manager form, as shown in the following figure. To Configure Users to Manage Power Outlets on IPDUs 1. Go to Applications > IPDU Power Mgmt. > Users Manager. The Users Manager form appears. 2. To disable a user s ability to manage power, select the username from the Users Information list and then click Delete. 3. To edit a user, select the username from the Users Information list and then click Edit. The Add/Edit User x Outlets dialog box appears. 4. To add a new user, click Add. The Add/Edit User x Outlets dialog box appears. 5. In the Add/Edit User x Outlets dialog box, do the following as appropriate. a. Enter the username in the User field. b. Enter or modify the numbers of the outlets to which the user is assigned in the Outlets field. Use a comma to separate outlet numbers, and use a hyphen to indicate a range of outlets (for example: 1, 3, 4, 6-8). 6. Click OK. The Users Information list displays the changes. 7. Click apply changes. 128

159 Applications Configuration On the Configuration form under Applications > IPDU Power Mgmt., you can specify the following: An alias for the IPDU A threshold current between 1 and xx amperes. (The maximum current depends on the AlterPath PM model. Refer to "View IPDUs Info" section to determine your PM model. Any of the following actions to occur if the threshold current is exceeded on the IPDU. Over-current protection. If enabled, the outlets on the IPDU cannot be turned on, when the current on the IPDU exceeds the selected threshold. Syslog messages are generated Buzzer sounds if the current exceeds the defined threshold The Configuration form shows an entry for each serial port that has an AlterPath PM IPDU connected to, and is configured for power management. The first connected IPDU is called the master, the second and subsequentlyconnected IPDUs are called slaves. On the form Master Unit refers to the first or only connected IPDU. When IPDUs are daisy-chained, the form displays additional lines to allow you to specify separate alarm thresholds for slave IPDU(s). The following figure shows the Configuration form when two AlterPath PMs are connected to Serial port 1 configured for power management. BLACK BOX CS Installation, Administration, and User s Guide 129

160 Applications Menu & Forms Figure 7-12: Expert > Applications > IPDU Power Mgmt. > Configuration Note: The number of amps shown in the Master Unit (and Slave units if available) pull-down menu varies according to the model of the connected PM. Figure 7-12 shows number 15 for two 15 amp PMs as a Master and a Slave. To Specify Names, Alarms, Syslogging, and Over Current Protection for IPDUs Perform this procedure if you want to specify an alias or configure a threshold current to trigger alarms, syslogging, or over-current protection for an IPDU. 1. Go to Applications > IPDU Power Mgmt. > Configuration. 2. The Configuration form displays entries for all ports configured for power management. Perform the following steps for each IPDU. a. Assign a name to the IPDU in the Name field, if desired. b. For each AlterPath PM, click the appropriate check boxes to enable or disable Over Current Protection, the generation of Syslog files, and the sounding of a Buzzer. All of the selected actions occur if a defined threshold is exceeded on the IPDU. c. If enabling over-current protection, a buzzer, or alarm notification, select an Alarm Threshold from the pull-down menu. 130

161 Applications 3. Click apply changes. Software Upgrade [for the AlterPath PM] On the Software Upgrade form under Applications > IPDU Power Mgmt., you can upgrade the software on AlterPath PM IPDUs. The following figure shows the Software Upgrade form listing the current software version on the AlterPath PM IPDU connected to Serial Port 1. Figure 7-13:Expert > Applications > IPDU Power Mgmt. > Software Upgrade An entry for each serial port configured for power management, and information about each directly-connected PM is displayed. The primary connected IPDU is referred to as the master, and any daisy-chained PMs are called slaves. The form displays the version number of the software that is currently installed on each PM. To upgrade IPDU software using this form, you first must download a morerecent version of the AlterPath PM software into the CS s /tmp directory with the filename pmfirmware. Clicking the Refresh button checks for a more-recent version of the PM firmware in the /tmp/pmfirmware file. If the /tmp/pmfirmware file is present and the software version it contains is more recent than the installed version, information about the new version is displayed, and an Update button appears on the form. BLACK BOX CS Installation, Administration, and User s Guide 131

162 Applications Menu & Forms To Download AlterPath PM Software You can use this procedure to download the AlterPath PM software. 1. On a computer in the same subnet as the CS, bring up a browser and go to 2. Find the section on the downloads page for the AlterPath PM, and compare the latest driver s version number to the version shown in the Applications > IPDU Power Mgmt. > Software Upgrade form. The following example shows the AlterPath PM section on the downloads page. For example, the version of AlterPath PM firmware in the previous figure is Software Version: In this case the software is updated. You would download it if it is more recent than the version shown on the form. 3. Click the Firmware link. 4. In the version directory, click the name of the binary you want to download. For example, pm_150.bin is the name of the version firmware file. 5. After the download completes, copy the file to the /tmp folder with the name pmfirmware. To Upgrade Software on an AlterPath PM Perform this procedure to upgrade the software on an AlterPath PM. 132

163 Applications This procedure requires the following: A more-recent version of the AlterPath PM software than the one shown on the Software Upgrade form. You downloaded the more-recent version of the AlterPath PM software and copied it into the CS s /tmp directory with the filename pmfirmware. 1. Go to Applications > Power Mgmt. > Software Upgrade. The Software Upgrade form displays. 2. Click the Refresh button. If a /tmp/pmfirmware exists containing a more recent version of the PM firmware than the one currently installed, an Update button appears. 3. Click Update. 4. Click apply changes. IPDU Multi-Outlet Ctrl Selecting Applications > IPDU Multi-Outlet Ctrl display the following form used for managing power on a group of outlets that provide power to a multi power supply server or device connected to a serial port. BLACK BOX CS Installation, Administration, and User s Guide 133

164 Applications Menu & Forms Figure 7-14: Expert > Applications > IPDU Multi-Outlet Ctrl Whether the power supplies are connected to the same PM or not, all outlets that are configured to the same serial port can be treated as a group and controlled simultaneously from this form. The following form displays if Multi-Outlet Ctrl is not configured. For the procedure, see To Configure a Serial Port for IPDU or IPMI Power Management on page

165 Applications Figure 7-15: Expert > Applications > Multi-Outlet Ctrl [not configured] Prerequisites for Multi-Outlet Control In order to control groups of outlets from the IPDU Multi-Outlet Control page, the following prerequisites must be met. An AlterPath PM must be plugged into one of the serial ports, and that serial port must be configured for power management. A device connected to a serial port must be plugged into at least two outlets on the PM. The PM and the outlet numbers to which the device is plugged must be configured on the serial port that the device is connected to. Power Management Icons In the first line of each group, the light bulb and the lock icons as well as the Cycle button operate over the entire group. The light bulb and lock icons next to the individual outlets are used to display the status of each outlet but cannot be used to control the individual outlets. BLACK BOX CS Installation, Administration, and User s Guide 135

166 Applications Menu & Forms Figure 7-16: Expert > Applications > Multi-Outlet Control Icons The icons in the first line of each group are described in the following table. Table 7-5: Expert > IPDU Multi-Outlet Ctrl form icons Button Purpose A grey light bulb icon indicates that the group is off. A yellow light bulb indicates that the group is on. Clicking the light bulb icon once changes the power status of all of the outlets in the group. A grey and open lock icon indicates that the outlets are unlocked and can be powered on or off. A full-color, closed lock icon indicates that the outlet is locked and cannot be turned on or off. Clicking the lock icon once changes the lock status of all of the icons in the group. Turn power briefly off and then on again 136

167 Applications Note: Only one outlet needs to be powered on or unlocked in order for the entire group to be considered on or unlocked. In this case, it takes two clicks to turn the power off or to lock the entire group instead of the one click. (one click is sufficient when all of the outlets are in the same state). The first click turns the other outlets on or unlocks them so that all the outlets are in the same state; the second click turns all of the outlets off or locks them. The Cycle button operates only if all outlets of a group are turned on. Note: The "power up interval" parameter configured for each outlet plays an important role in the power up sequence of multi-outlet devices because the next outlet in the group turns on only after the power up interval specified for the current outlet has elapsed. To configure this parameter go to Applications > IPDU Power Mgmt > Outlets Manager > Edit. To Power On or Power Off a Group of Outlets in the Same Power State Use these instructions if all of the outlets in a group are turned either off or on. 1. Go to Applications > IPDU Multi-Outlet Ctrl. 2. To power on the group of outlets in OFF state, click the grey light bulb adjacent to the group name. 3. To power off the group of outlets in ON, click the yellow light bulb adjacent to the group name. To Power On or Power Off a Group of Outlets in Different Power States Use these instructions if not all of the outlets in a group are turned either off or on. 1. Go to Applications > IPDU Multi-Outlet Ctrl. 2. To power on the group, click the yellow light bulb adjacent to the group name. All of the outlets turns on. 3. To power off the group, do the following steps: BLACK BOX CS Installation, Administration, and User s Guide 137

168 Applications Menu & Forms a. Click the yellow light bulb icon adjacent to the group name once to turn all of the outlets off. All of the outlets are in the same state. b. To turn all of the outlets on, click the grey light bulb icon adjacent to the group name. To Lock or Unlock a Group of Outlets in the Same Power State Use these instructions if all of the outlets in a group are either locked or unlocked. 1. Go to Applications > IPDU Multi-Outlet Ctrl. 2. To lock the group of outlets, click the open padlock icon adjacent to the group name. 3. To unlock the group of outlets, click the closed padlock icon adjacent to the group name. To Lock or Unlock a Group of Outlets in Different Lock States Use these instructions if not all of the outlets in a group are locked or unlocked. 1. Go to Applications > IPDU Multi-Outlet Ctrl. 2. To lock the group of outlets, do the following steps: a. Click the open padlock icon adjacent to the group name once to unlock all of the outlets. All of the outlets are in the same state (open padlock). b. To lock all of the outlets, click the open padlock icon adjacent to the group name. 3. To unlock the group of outlets, click the closed padlock icon adjacent to the group name. To Turn the Power of a Group of Outlets Off and On Again This procedure works only with groups of outlets that are all turned on. 138

169 Applications 1. Go to Applications > IPDU Multi-Outlet Ctrl. 2. Make sure that all of the outlets are turned on. 3. See To Power On or Power Off a Group of Outlets in the Same Power State on page 137 if needed. 4. Click the Cycle button adjacent to the group name. IPMI Power Management Intelligent Platform Management Interface or IPMI refers to the monitoring and control functions that are built into the platform hardware and primarily is used for monitoring a server s hardware such as temperature, voltage, and errors. On the IPMI Power Mgmt. form under Applications, you can enable and perform power management of devices that have IPMI controllers. As shown in the following figure, if no IPMI devices have been added previously, only the Add button appears. Figure 7-17:Expert > Applications > IPMI Power Mgmt. When an Add button or Edit button is pressed, a form appears for adding or editing a device. BLACK BOX CS Installation, Administration, and User s Guide 139

170 Applications Menu & Forms Figure 7-18:Expert > IPMI Power Mgmt. Add/Edit IPMI Device Dialog Boxes After you fill out the fields or make changes and save the changes, the device is added to the IPMI Devices list or the configuration for the device is changed. The following figure shows an entry for an IPMI server. Figure 7-19:Expert > IPMI Power Mgmt. Device Entry Example Once an IP address for a device is added to the list of IPMI devices on this form, any user authorized for power management can turn power on and off and cycle power for the IPMI device through the Web Manager. Also, users 140

171 Applications authorized to connect to serial ports can perform IPMI power management on a serially-connected device while connected. To configure power management of IPMI devices the following CS information must be obtained from the IPMI device s administrator. Table 7-6: Expert > IPMI Information Field Name Device Alias IP Address Authentication type Access Level Username Password Description Optional IP address of the device on the network None, Straight Password, MD5, MD2 (User/Operator/Administrator) Default is User. Default is NULL user. Password for administering the remote device The information is updated in the /etc/portslave/pslave.conf and /etc/ipmiserver.conf files. The admin or user in the admin group can Add, Edit, or Delete an IPMI device in an IPMI Devices List. The user with power management privileges can manage power on listed IPMI devices. The following table describes the icons available in the IPMI Power Mgmt. form. Table 7-7: Expert > IPMI Power Mgmt. Form Icons Button Purpose A yellow light bulb indicates the current state of the device. Clicking the light bulb icon toggles the state of the device. BLACK BOX CS Installation, Administration, and User s Guide 141

172 Applications Menu & Forms Button Purpose When the status is unknown, a question mark appears instead of the light bulb. A question mark indicates either of the following conditions. The device was added or deleted and the changes were not saved. The device did not answer IPMI requests. Turn power briefly off and then on again Add and configure a new IPMI device. Select an IPMI device to review or change its configuration. Delete an IPMI device. To Delete, Add, or Edit an IPMI Device to Enable or Disable IPMI Power Management 1. Go to Applications> IPMI Power Mgmt. The IPMI Power Management form appears. 2. To delete a previously added IPMI device, click the Delete button on the line with the device s name. 3. To add a device, click the Add button, and perform the following steps. a. Enter an alias for the device in the Alias: field, if desired. b. Enter the IP address of the IPMI device in the IP Address field. c. Choose an authentication type, if desired, from the Authentication Type pull-down menu. d. Choose a user permission type from the Access Level pull-down menu. The default is User. e. Enter a Username. 142

173 Applications f. Enter a password for administering the remote device in the Password field and go to Step To edit the configuration for a device, click the Edit button on the line with the device s name, and make the desired changes on the Edit dialog box. 5. Click OK. 6. Click apply changes. To Manage Power on an IPMI Device 1. Go to Applications > IPMI Power Mgmt. Entries for all previously-defined IPMI devices appear on the form. 2. To toggle the state of a device, click the adjacent light bulb icon. 3. To briefly turn the power off then on again, click the Cycle button. To Configure a Serial Port for IPDU or IPMI Power Management 1. Go to Ports > Physical Ports 2. To select a port or ports to modify, click the appropriate Modify Ports button, and then the Power Management tab. 3. To enable Power Management of a device connected to the current port and plugged into a connected IPDU, click Enable Power Management on this port.. The following form appears. BLACK BOX CS Installation, Administration, and User s Guide 143

174 Applications Menu & Forms Figure 7-20: Expert > Serial Port > Power Management > Enable Power Management 4. Click the Add button The Add Outlet dialog box appears. Figure 7-21: Expert > Power Management Add Outlet Dialog Box 5. Enter the outlet number(s) - separated by comma - into which the device is connected to. 6. Click OK. 144

175 Applications The power management port and the specified outlet numbers display on the PowerMgmt Port list. 7. Enter the power management hot key in the Power Management Key field. Enter a caret (^) for the escape key, as in ^p. The caret stands for the Ctrl key. To Configure a User for IPDU Power Management While Connected To a Serial Port Perform this procedure to allow a user to perform power management for a device while connected to the device through one of the CS s serial ports. 1. To allow everyone with access permissions for this port to perform power management on this port, click the Allow All Users radio button. 2. To restrict power management on this port to a restricted list of users authorized to access this port, click the Allow Users/Groups. Figure 7-22: Expert > Serial Port > Power Management > User Permissions 3. Enter a valid username or groupname in the New User/Group field, and click Add. 4. Click Done. 5. Click apply changes. BLACK BOX CS Installation, Administration, and User s Guide 145

176 Applications Menu & Forms To enable IPMI Power Management of an IPMI device connected to the currently-selected port 1. Check the checkbox next to Enable IPMI on this port. The IPMI key and IPMI Server fields appear. Figure 7-23: Expert > Serial Port > Power Management > Enable IPMI 2. Enter an IPMI hot key. A user of the device connected to this serial port can use this hot key to bring up the IPMI power management screen while connected to the port. Enter the key combination in the IPMI key field with ^, as in ^I. The caret (^) stands for the Ctrl key. Note: The default IPMI hot key is ^I. The hexadecimal code for the <Ctrl-I> is the same as the keyboard s <Tab> key. You can choose to change the default IPMI hotkey. 3. Select the name of the previously-added IPMI device from the IPMI Server pull-down menu. 4. Click Done. 5. Click apply changes. Terminal Profile Menu On the Terminal Profile Menu form under Applications, you can define a terminal command menu. This menu is used if a terminal is connected to one of the serial ports and is configured as a local terminal. A computer terminal 146

177 Applications configured as a local terminal launches a session directly on the CS with access to the Linux commands on the CS unless you configure a menu here. The following figure shows an empty menu. Figure 7-24:Expert > Applications > Terminal Profile Menu The menu can contain any command recognized by the Linux operating system on the CS. The most common use of this feature is to create multiple menu options for launching SSH sessions on remote hosts. When you click Add, the Add Option dialog box appears, as shown in the following figure. Figure 7-25: Expert >Terminal Profile Menu Add Option Dialog Box BLACK BOX CS Installation, Administration, and User s Guide 147

178 Applications Menu & Forms For example, you can create a menu called SSH to Servers with options that launch SSH connections to several servers, such as the one shown in the following screen example. Figure 7-26: Expert > Terminal Profile Menu Example The command menu then appears when the terminal is powered on. To Create a Menu for a Local Computer Terminal 1. Go to Applications > Terminal Profile Menu. The Terminal Profile menu displays. 2. Enter a title for the menu in the Menu title field. 3. To edit an existing menu option, select the Action Name from the table and then click Edit. 4. To add a new menu option, click Add. The Add Option dialog box appears. a. Enter a title for the menu option in the Title field. b. Enter an action or command to be executed when the user clicks the menu option in the Action/Command field. c. Click OK. 148

179 Applications 5. Click apply changes. BLACK BOX CS Installation, Administration, and User s Guide 149

180 Applications Menu & Forms 150

181 Chapter 8 Network Menu & Forms This Chapter describes the Network menu and the related forms. The following table provides a description of the left menu panel and links to the detailed information and procedures. Table 8-1: Expert > Network Menu Menu Selection Use this menu to: Where Documented Host Settings Syslog PCMCIA Management VPN Connections Configure the network parameters such as Host Name, IP addresses, DNS services, Gateway, and Bonding Configure how the CS will handle its syslog messages. The CS generates syslog messages related to users connecting to ports, login failures and other information that can be used for audit and control purposes. Configure the optional PCMCIA cards. CS supports several PCMCIA cards including modem, ISDN, GSM, CDMA, wireless LAN, Ethernet LAN, Compact Flash, and IDE drives for data buffer storage. For a list of supported PCMCIA cards see Appendix C. Configure one or more VPN connections to other systems or CS attached devices. Page 152 Page 157 Page 158 Page 176

182 Network Menu & Forms Menu Selection Use this menu to: Where Documented SNMP Firewall Configuration Host Tables Static Routes Network Configure Simple Network Management Protocol (SNMP) with community names, OID and user names. This section and the dialog boxes guide you to configure the required parameters. Configure static IP tables, and how packets should be filtered. View information about the local network environment. View table of hosts; create, edit, and delete hosts. To manually add routes. Static routes are a very quick and effective way to route data from one subnet to different subnets. Page 181 Page 186 Page 201 Page 202 Host Settings When you select Network > Host Settings the following form appears. Figure 8-1: Expert > Network > Host Settings [DHCP Enabled] 152

183 Network If the DHCP is not enabled, then other options appear on the form as shown in the following figure. Figure 8-2: Expert > Network > Host Settings [DHCP Disabled] The following table provides a brief definition of the Host Settings form fields. Table 8-2: Expert > Host Settings Form Fields Filed Name Host Name Field Definition The fully qualified domain name identifying the specific host computer on the network. BLACK BOX CS Installation, Administration, and User s Guide 153

184 Network Menu & Forms Table 8-2: Expert > Host Settings Form Fields Filed Name Console Banner Primary IP Secondary IP Network Mask Secondary Network Mask MTU DNS Server Secondary DNS Server Domain Name Gateway IP Field Definition A text string designed to appear on the console upon logging into and exiting from a port as a way to verify or identify the particular port connection. IP address of the CS unit. The secondary IP address of the CS unit. By configuring a second IP address, the unit will be available for more than one network. The 32-bit number used to group IP addresses together or to indicate the range of IP addresses for a subnet. Optional. Maximum Transmission Unit used by the TCP protocol. Address of the Domain Name Server. Address of the backup Domain Name Server. The name that identifies the domain, for example, domainname.com. The IP address to the gateway on the subnet. 154

185 Network Table 8-2: Expert > Host Settings Form Fields Filed Name Bonding Field Definition Enables redundancy for the Ethernet devices using the standard Ethernet interface as the primary mode of access and a PCMCIA card as a secondary mode of access. If bonding is enabled, the following values should be set. Miimon: The interval in which the active interface is checked to see if it is still communicating (in milliseconds). Updelay: The time that the system will wait to make the primary interface active after it has been detected as up (in milliseconds). Caution: If you have set IP Filtering rules before bonding is activated, the interface reference in the firewall configuration will be eth0. You need to change the interface to bond0 in order to reference the bonded interface. See BLACK BOX CS Installation, Administration, and User s Guide, Chapter 3. To Configure Host Settings [Expert] 1. Go to Network > Host Settings. The Host Settings form appears. 2. By default, the DHCP is enabled. To disable DHCP, click the checkbox to remove the check mark. Additional fields appear. 3. Enter the name assigned to the IP address of the CS in the Host Name field. 4. Enter a console banner in the Console Banner field. BLACK BOX CS Installation, Administration, and User s Guide 155

186 Network Menu & Forms The console banner appears on the console upon logging into and exiting from a port as a way to verify or identify the particular port connection 5. Under Ethernet Port, complete or edit the following fields, as necessary. a. Enter the IP address of the CS in the Primary IP field. b. Enter the netmask in the Network Mask field. c. If the CS has a second Ethernet card in a PCMCIA slot, enter the CS s second IP address in the Secondary IP field. d. Specify the network mask of the secondary IP in the Secondary Network Mask field. e. Specify the desired maximum transmission unit in the Maximum Transmission Unit field. 6. Under DNS Service specify or change the following information, if desired. a. Enter the address of the domain name server in the Primary DNS Server field. b. If there is a backup DNS server, enter the address of the secondary DNS in the Primary DNS Server field c. Enter the domain in the Domain Name field. d. Enter the IP address of the gateway in the Gateway IP field. 7. If you are done go to step 9. If you are enabling Bonding continue to step To activate Bonding place a checkmark in the Enabled field. Miimon and Updelay fields appear. a. Enter a positive integer in the Miimon field. This value represents the interval in which the active interface is checked to see if it is still communicating, measured in milliseconds. b. Enter a positive integer in the Updelay field. This value represents the time that the system will wait to make the primary interface active after it has been detected as up, measured in milliseconds. 9. Click apply changes. 156

187 Network Syslog When Network > Syslog is selected the form shown in the following figure appears. Figure 8-3: Expert > Network > Syslog You can use the Syslog form to configure how the CS handles system logged messages. The Syslog form allows you to do the following: Specify one or more syslog servers to receive syslog messages related to ports. Specify rules for filtering messages. BLACK BOX CS Installation, Administration, and User s Guide 157

188 Network Menu & Forms The top field on the form CAS Ports Facility is used to tell CS where to send syslog messages. You can specify a facility number for the messages from serial ports. Obtain the facility numbers from the syslog server s administrator. You can send the syslog messages to: The console port for logging the messages even if no user is logged in) To all sessions where the root user is logged in To one or more syslog servers. You can add or remove syslog servers. The bottom part of the form has filtering rules for specifying which types of messages are forwarded based on the following criteria: Severity level: Emergency, Alert, Critical, Error, Warning, Notice, Info, Debug Category CAS log; Data Buffering log; Web log; or System log. To Configure Syslogging for Serial Ports and Specify Message Filtering 1. Go to Network > Syslog in Expert mode. The Syslog form appears. 2. Select a facility number for messages generated by serial ports by selecting the number from the CAS Ports Facility pull-down menu. 3. Select a destination for the Syslog messages by clicking the checkbox next to one or all of the options: Console, Root User, or Server. 4. Add a syslog server to the Syslog Servers list, by entering its IP address in the New Syslog Server field, and clicking the Add>> button. 5. Configure the message filtering as per your requirements. 6. Click apply changes. PCMCIA Management When Network > PCMCIA Management is selected the following form appears. 158

189 Network Figure 8-4: Expert > Network > PCMCIA Management You can use the PCMCIA management form to configure the following types of PCMCIA cards. For a list of the supported PCMCIA cards see Appendix C. 10/100 Base-T Ethernet b Wireless LAN V.90 Modem ISDN GSM CDMA Compact Flash IDE Hard Disk Note: You can insert a card at any time and the corresponding driver should load automatically. Before removing a card, however, you must use the Web Manager to eject the card and stop the system from using the card. If you install an IDE PCMCIA card in a slot, it automatically mounts and no configuration is necessary through this form. Note: CS supports GPRS and 1xRTT PCMCIA cards through a Generic Dial-Out application. For Configuration details refer to the CS Command Reference Guide, Chapter 7, Section 7.3 Generic Dial-Out. BLACK BOX CS Installation, Administration, and User s Guide 159

190 Network Menu & Forms To Configure a PCMCIA Card 1. Go to Network > PCMCIA Management. The PCMCIA Management form appears. 2. Insert the card into the PCMCIA slot on the front of the CS and Click the Insert button for the slot in which you installed the PCMCIA card. The following dialog box appears. 3. Click OK. The card information appears under the Card Type column as shown in the following figure. 4. Click the Configure button. 5. The Slot dialog box appears 160

191 Network 6. Select the desired PCMCIA card type from the pull-down menu. 7. Follow the procedure that corresponds to the type of the PCMCIA card you have installed. Configuring a Modem PCMCIA Card Page 164 Configuring an ISDN PCMCIA Card Page 165 Configuring a GSM PCMCIA Card Page 168 Configuring an Ethernet PCMCIA Card Page 170 Configuring a PCMCIA Compact Flash Card or a PCMCIA Hard Disk Drive Page 171 Configuring a Wireless LAN PCMCIA Card Page 173 Configuring a CDMA PCMCIA Card Page 175 Configuring a Modem PCMCIA Card You can use the PCMCIA Management form under Network to enable a remote user to call into the CS through an installed modem PCMCIA card. When you select Modem from the pull-down menu, the dialog box shown in the following figure appears. BLACK BOX CS Installation, Administration, and User s Guide 161

192 Network Menu & Forms Figure 8-5: Expert > PCMCIA Modem Card Configuration Dialog Box The following table provides a brief description of the fields available in the Modem dialog box. Table 8-3: Expert > Form Fields for a Modem Card Field Name [PCMCIA Card] PPP Local IP Remote IP Call Back Phone Number Definition Pull-down menu to select the type of PCMCIA card that you are using. Check box to enable point-to-point protocol. The local IP address of the PCMCIA card. The remote IP address of the PCMCIA card. Check box to enable the callback security feature. The phone number that the CS uses to call back. If you click the PPP checkbox, additional fields for a local and remote IP address and a Call Back checkbox appear, as shown in the following figure. 162

193 Network Figure 8-6: Expert > PCMCIA Modem Card Configuration Dialog Box - PPP If you enable Call Back, the Phone Number field appears on the Slot dialog box, as shown in the following figure. Figure 8-7: Expert > Modem PCMCIA Card Configuration Dialog Box - Call Back BLACK BOX CS Installation, Administration, and User s Guide 163

194 Network Menu & Forms To Configure a Modem PCMCIA Card 1. Install the modem card and select Modem from the pull-down menu on the PCMCIA Management form. 2. To enable PPP, do the following steps: a. Check the PPP checkbox. b. The Local IP and the Remote IP fields, and the Call Back check box appear on the Slot dialog box. c. Enter an IP address in the Local IP field, if desired. By default, the IP address of the CS is used. Only change the IP address if you have a specific reason to do so. d. In the Remote IP field, specify the IP address to assign to the other end of the PPP connection, if desired. By default, the IP address is assigned. Only change the IP address if you have a specific reason to do so. 3. To enable call back, do the following: a. Check the Call Back check box. The Phone Number field appears on the Slot dialog box. b. Enter a number to use to call back the modem. 4. Click OK. 5. Click apply changes. Configuring an ISDN PCMCIA Card You can use the PCMCIA Management form under Network to enable users to connect to the CS through an ISDN PCMCIA card. When you select ISDN from the pull-down menu, the dialog box shown in the following figure appears. 164

195 Network Figure 8-8: Expert > ISDN PCMCIA Card Configuration Dialog Box The following table provides a brief description of the fields available in the ISDN dialog box. Table 8-4: Expert > Form Fields for an ISDN Card Field Name [PCMCIA Card] Local IP Remote IP Call Back Phone Number Definition Select ISDN from the pull-down menu. The local IP address of the PCMCIA card. The remote IP address of the PCMCIA card. Check box to enable the callback security feature. The phone number that CS uses to call back. To Configure an ISDN PCMCIA Card 1. Install the ISDN card and select ISDN from the pull-down menu on the PCMCIA Management form. The Local IP and Remote IP fields and the Call Back check box appear on the Slot dialog box. BLACK BOX CS Installation, Administration, and User s Guide 165

196 Network Menu & Forms 2. Enter an IP address in the Local IP field, if desired. By default, the IP address of the CS is used. Only change the IP address if you have a specific reason to do so. 3. In the Remote IP field, specify the IP address to assign to the other end of the PPP connection, if desired. By default, the IP address is assigned. Only change the IP address if you have a specific reason to do so. 4. To enable call back, do the following: a. Check the Call Back check box. The Phone Number field appears on the Slot dialog box. b. Enter a number for CS to use to call back modem. 5. Click OK. 6. Click apply changes. Configuring a GSM PCMCIA Card You can use the PCMCIA Management form under Network to enable a remote user to call into the CS through an installed and configured GSM PCMCIA card. When you select GSM from the pull-down menu, the dialog box shown in the following figure appears. 166

197 Network Figure 8-9: Expert > GSM PCMCIA Card Configuration Dialog Box When the Call Back checkbox is checked, the Phone Number field appears as shown in the following figure. Figure 8-10: Expert > GSM PCMCIA Card Configuration Dialog Box - Call Back BLACK BOX CS Installation, Administration, and User s Guide 167

198 Network Menu & Forms The following table provides a brief description of the fields available in the GSM dialog box. Table 8-5: Expert > Form Fields For a GSM Card Field Name Definition [PCMCIA Card] Local IP Remote IP Pin Number Call Back Phone Number Select GSM from the pull-down menu. The local IP address of the PCMCIA card. The remote IP address of the PCMCIA card. The personal identification number associated with the GSM. Check box to enable the callback security feature. The phone number that CS uses to call back. To Configure a GSM PCMCIA Card 1. Install the GSM card and select GSM from the pull-down menu on the PCMCIA Management form. The Local IP, Remote IP, and Pin Number fields and the Call Back check box appear on the Slot dialog box. 2. Enter an IP address in the Local IP field, if desired. By default, the IP address of CS is used. Only change the IP address if you have a specific reason to do so. 3. In the Remote IP field, specify the IP address to assign to the other end of the PPP connection, if desired. By default, the IP address is assigned. Only change the IP address if you have a specific reason to do so. 4. Enter a personal identification number known to the owner of the GSM card in the PIN Number field. 5. To enable call back, do the following: 168

199 Network a. Check the Call Back check box. The Phone Number field appears on the Slot dialog box. b. Enter a number for the CS to use to call back the GSM phone. 6. Click OK. 7. Click apply changes. Configuring an Ethernet PCMCIA Card You can use the PCMCIA Management form under Network to configure an Ethernet PCMCIA card. When you select Ethernet from the pull-down menu, the dialog box shown in the following figure appears. Figure 8-11: Expert > Ethernet PCMCIA Card Configuration Dialog Box The following table provides a brief description of the fields available in the Ethernet dialog box Table 8-6: Expert > Form Fields for an Ethernet Card. Field Name Definition [PCMCIA Card] IP Address Select Ethernet from the Pull-down menu. The local IP address of the Ethernet. BLACK BOX CS Installation, Administration, and User s Guide 169

200 Network Menu & Forms Field Name Network Address Definition The network address of the Ethernet. To Configure an Ethernet PCMCIA Card 1. Install the Ethernet card and select Ethernet from the pull-down menu on the PCMCIA Management form. The IP Address and Network Mask fields appear on the Slot dialog box. 2. In the IP address field, enter the IP address to assign to the Ethernet port. 3. In the Network Mask field, enter the netmask to assign to the subnet. 4. Click OK. 5. Click apply changes. Configuring a PCMCIA Compact Flash Card or a PCMCIA Hard Disk Drive You can use the PCMCIA Management form under Network to configure a PCMCIA Compact Flash card or a PCMCIA Hard Disk Drive. When you select Compact Flash/Hard Disk from the pull-down menu, the dialog box shown in the following figure appears. 170

201 Network Figure 8-12: Expert > PCMCIA Compact Flash/Hard Disk Configuration Dialog Box The following table provides a brief description of the fields available in the Compact Flash/Hard Disk dialog box. Table 8-7: Expert > Form Fields for a Compact Flash/Hard Disk Field Name Definition [PCMCIA Card] Enable Use for Data Buffering Select Compact Flash/Hard Disk from the Pulldown menu. Check box to enable the storage device. Check box to use the storage device for data buffering. To Configure a Compact Flash PCMCIA Card or a PCMCIA Hard Disk Drive 1. Install the compact flash card or the hard disk drive and select Compact Flash/Hard Disk from the pull-down menu on the PCMCIA Management form. BLACK BOX CS Installation, Administration, and User s Guide 171

202 Network Menu & Forms The Enable checkbox appears on the Slot dialog box. 2. Click the Enable checkbox. The Use for data buffering checkbox appear on the Slot dialog box. 3. If desired, uncheck the Use for data buffering checkbox. Default is checked. 4. Click OK. 5. Click apply changes. Configuring a Wireless LAN PCMCIA Card You can use the PCMCIA Management form under Network to configure a Wireless LAN PCMCIA card. When you select Wireless LAN from the pull-down menu, the dialog box shown in the following figure appears. Figure 8-13: Expert > PCMCIA Wireless LAN Card Configuration Dialog Box The following table provides a brief description of the fields available in the Wireless LAN dialog box. 172

203 Network Table 8-8: Expert > Form Fields for a Wireless LAN Card. Field Name Definition [PCMCIA Card] IP Address Network Mask MyPrivateNet (ESSID) Channel Encrypted Key Pull-down box to select the type of PCMCIA card that you are using. The local IP address of the Ethernet. The network address of the Ethernet. The unique identifier for the wireless access point. The communication channel with the access point. The translation of data into code during transmission. The key or password to decode the encrypted data. To Configure a Wireless LAN PCMCIA Card 1. Install the wireless LAN card and select Wireless LAN from the pulldown menu on the PCMCIA Management form. 2. In the IP address field, enter an IP address. 3. In the Network Mask field, enter the netmask for the subnet. 4. In the MyPrivateNet (ESSID) field, enter the SSID for communicating with others in your network. 5. In the Channel field, enter a channel number. 6. Click the Encrypted checkbox, if an encrypted data communication is required. 7. Enter a unique key for decoding the encrypted data. 8. Click OK. 9. Click apply changes. BLACK BOX CS Installation, Administration, and User s Guide 173

204 Network Menu & Forms Configuring a CDMA PCMCIA Card You can use the PCMCIA Management form under Network to configure a CDMA PCMCIA card. When you select CDMA from the pull-down menu, the dialog box shown in the following figure appears. Figure 8-14: Expert > PCMCIA CDMA Card Configuration Dialog Box CDMA cards are modem cards that makes it possible for CS to receive a dialin connection and support callback feature using the "ppp" protocol. The following table provides a brief description of the fields available in the CDMA dialog box. Table 8-9: Expert > Form Fields for a CDMA Card. Field Name Definition [PCMCIA Card] Local IP Remote IP Pull-down box to select the type of PCMCIA card that you are using. The local IP address of the CDMA card used by the ppp connection. The remote IP address of the CDMA card used by the ppp connection. 174

205 Network Field Name Speed Additional Initialization Call Back Phone Number Definition The speed used by CS to access the card. Additional initialization parameter to be sent to the card. CDMA configuration has a default command sequence to initialize the card, but if additional initialization command is required by the card, it will be added to default command sequence. For example, additional initialization parameters may be required in communication networks of some countries. Check box to enable the callback security feature The phone number that CS uses to call back. To Configure a CDMA PCMCIA Card 1. Install the CDMA card and select CDMA from the pull-down menu on the PCMCIA Management form. 2. In the Local IP field, enter the local IP address. 3. In the Remote IP field, enter the remote IP address. 4. Form the Speed pull-down menu, select the speed defined by the specifications of the CDMA card you are using. 5. In the Additional Initialization field, enter additional parameters if required by the card. 6. To enable call back, do the following: a. Check the Call Back check box. The Phone Number field appears on the Slot dialog box. b. Enter a number for the CS to use to call back the CDMA card. 7. Click OK. 8. Click apply changes. BLACK BOX CS Installation, Administration, and User s Guide 175

206 Network Menu & Forms Ejecting a PCMCIA Card Use the Eject button on the PCMCIA management form to eject any PCMCIA card before physically ejecting it. Any other method can cause a kernel panic. To Eject a PCMCIA Card From the Card Slot 1. Go to Network > PCMCIA Management. The PCMCIA Management form appears. 2. Click the Eject button adjacent to the card you want to remove. The card type clears under the Card Type column. 3. Click apply changes. 4. Physically remove the card from the PCMCIA slot on the front of the CS. VPN Connections VPN, or Virtual Private Network enables a secured communication between CS and a remote network by utilizing a gateway, and creating a secured tunnel between CS and the gateway. IPSec is the protocol used to construct the secure tunnel. IPSec provides encryption and authentication services at the IP level of the protocol stack. When VPN Connections is selected under Network, the form shown in the following figure appears. 176

207 Network Figure 8-15: Expert > Network > VPN Connections You can use the form to add a VPN connection or edit one that is already in the list. When you click the Edit or Add buttons, a New/Modify Connection form appears, as shown in the following figure. The form displays different fields depending on whether RSA Public Keys or Shared Secret are selected. BLACK BOX CS Installation, Administration, and User s Guide 177

208 Network Menu & Forms Figure 8-16: Expert > VPN New/Modify Connection Dialog Box The remote gateway is referred to as the Remote or Right host, and the CS is referred to as the Local or Left host. If left and right are not directly connected, then you must also specify a NextHop IP address. The next hop for the remote or right host is the IP address of the router to which the remote host or gateway running IPSec sends packets when delivering them to the left host. The next hop for the left host is the IP address of the router to which the CS sends packets to for delivery to the right host. A Fully Qualified Domain Name in the ID fields for both the Local ( Left ) host and the Remote ( Right ) host where the IPSec negotiation takes place should be indicated. The following table describes the fields and options on the form. Check with your system administrator who defined and configured the security protocols, if needed. The information must match exactly on both ends, local and remote. 178

209 Network Table 8-10: Expert > Field and Menu Options for Configuring a VPN Connection Field Name Definition Connection Name Authentication Protocol Authentication Method ID IP Address NextHop Subnet RSA Key (If RSA Public Keys is selected) Pre-Shared Secret (If Shared Secret is selected) Any descriptive name you want to use to identify this connection such as MYCOMPANYDOMAIN-VPN. The authentication protocol used, either ESP (Encapsulating Security Payload) or AH (Authentication Header). Authentication method used, either RSA Public Keys or Shared Secret. This is the hostname that a local system and a remote system use for IPSec negotiation and authentication. It can be a Fully Qualified Domain Name preceded For example, hostname@xyz.com The IP address of the host. The router through which the CS (on the left side) or the remote host (on the right side) sends packets to the host on the other side. The netmask of the subnetwork where the host resides. Note: Use CIDR notation. The IP number followed by a slash and the number of one bits in the binary notation of the netmask. For example, /24 indicates an IP address where the first 24 bits are used as the network address. This is the same as You need to generate a public key for the CS and find out the key used on the remote gateway. You can use copy and paste to enter the key in the RSA Key field. Pre-shared password between left and right users. BLACK BOX CS Installation, Administration, and User s Guide 179

210 Network Menu & Forms Field Name Boot Action Definition To Configure VPN The boot action configured for the host, either Ignore, Add, Start. To enable VPN, make sure that IPSec is enabled through the security profile section. 1. Go to Network > VPN Connections. The VPN Connections form appears. 2. To edit a VPN connection, select the name of the VPN connection, and click the Edit button. 3. To add a VPN Connection, click the Add button. The New/Modify Connection dialog box appears. 4. Enter any descriptive name you choose for the connection in the Connection Name field. 5. Select either ESP or AH from the Authentication Protocol pull-down menu. 6. Select Shared Secret or RSA Public Keys from the Authentication Method pull-down menu. 7. Set up the right and left hosts by doing the following steps. a. Enter the fully qualified domain name of the hosts in the ID fields. These are the hostnames where the IPSec negotiation and authentication happens. For example, hostname@xyz.com b. Enter the IP address of the host in the IP Address fields. c. Enter the IP address of the router through which the host s packets reach the Internet in the NextHop fields. d. Enter the netmask for the subnet in the Subnet fields in CIDR notation. For example, /24 which translates to

211 Network SNMP e. If RSA Key is selected, generate the key for the CS (left host) and find out the key from the remote gateway (right host). You can use copy and paste to enter the key in the RSA Key field. f. If Shared Secret is selected, enter the shared secret in the Pre- Shared Secret field. 8. Select either Ignore, Add, or Start from the Boot Action pulldown menu. 9. Click OK. 10. Click apply changes. SNMP or Simple Network Management Protocol is a set of protocols for managing complex networks. SNMP works by sending messages, called protocol data units (PDUs) to different parts of a network. SNMP-compliant devices (agents), store data about themselves in Management Information Bases (MIBs) and return this data to the SNMP requesters. The CS SNMP agent supports SNMPv1/v2 and v3. To use SNMP v1 or v2, you need to specify a community name, a source IP address or a range of IP addresses, an object ID (OID), and permission (read-write or read-only). SNMP v3 requires: user name, password, OID, and permission. Selecting Network > SNMP brings up the form shown in the following figure. BLACK BOX CS Installation, Administration, and User s Guide 181

212 Network Menu & Forms Figure 8-17: Expert > Network > SNMP You can use this form to enable notifications about significant events or traps from CS to an SNMP management application, such as HP Openview, Novell NMS, IBM NetView, or Sun Net Manager. The following table explains the required parameters to complete the SNMP form and the associated dialog boxes. 182

213 Network Field or Menu Option Table 8-11: Expert > Fields and Menu Options for SNMP Configuration Description SysContact SysLocation Community Source OID Permission User Name and Password The address of the CS s administrator, for example, support@bb.com. The physical location of the CS. SNMP v1 and v2 only. A Community defines an access environment. The type of access is classified under Permission : either read only or read write. The most common community is public. Take caution in using a public community name as it is commonly known. By default, the public community cannot access SNMP information on the CS. SNMP v1 and v2 only. Valid entries are default or a subnet address, for example, /24. Object Identifier. Each managed object has a unique identifier. Read Only access to the entire MIB (Management Information Base) except for SNMP configuration objects. Read/Write access to the entire MIB except for SNMP configuration objects. SNMP v3 only. Clicking the Add or Edit buttons under SNMPv1/SNMPv2 Configuration brings up the New/Mod SNMP v1 v2 Configuration dialog box, as shown in the following figure. BLACK BOX CS Installation, Administration, and User s Guide 183

214 Network Menu & Forms Figure 8-18: Expert > New/Mod SNMP v1 v2 Configuration Dialog Box Clicking the Add or Edit buttons under SNMPv3 Configuration brings up the New/Mod SNMP v3 Configuration dialog box, as shown in the following figure. Figure 8-19:Expert > New/Mod SNMP v3 Configuration Dialog Box To Configure SNMP 1. Go to Networks > SNMP. The SNMP form appears. 2. To enable any version of SNMP, do the following: To add an SNMPv1/SNMPv2 entry, press the Add button under the SNMPv1/SNMPv2 Configuration table. To add an SNMPv3 entry, press the Add button at the bottom of the SNMPv3 Configuration table. 184

215 Network The New/Modify SNMP Daemon Configuration dialog box appears. 3. To edit any SNMP configuration, do the following steps. a. To edit an SNMPv1/SNMPv2 entry, select the entry from the SNMPv1/SNMPv2 Configuration list and click the Edit button. b. To edit an SNMPv3 entry, select an entry from the SNMPv3 Configuration list and click the Edit button. The New/Modify SNMP Daemon Configuration dialog box appears. 4. For SNMP v1 or v2 configuration, enter or change the following information: a. Enter the community name in the Community field. b. Enter the source IP address or range of IP addresses in the Source field. 5. For SNMP v3 configuration, enter or change the following information: a. Enter the user name in the User name field. b. Enter the password in the Password field. Note: The SNMPv3 password must be less than 31 characters. 6. For any version of SNMP, do the following steps. a. Enter the unique object identifier for the object in the OID field. b. Choose Read Only or Read/Write from the Permission field. 7. Click OK. 8. Click apply changes Note: In addition to SNMP configuration described in this section, you need to make sure SNMP service is enabled and configured for one or more serial ports in order to send SNMP traps. The related tasks are listed in the following table. BLACK BOX CS Installation, Administration, and User s Guide 185

216 Network Menu & Forms Task Table 8-12: Expert > Tasks for Configuring SNMP Where Documented To configure one or more serial ports to send SNMP traps. See SNMP Trap Notifications Entry on page 302 Firewall Configuration Firewall configuration, also known as IP filtering, refers to the selective blocking of the passage of IP packets between global and local networks. The filtering is based on rules that describe the characteristics of the packet. For example, the contents of the IP header, the input/output interface, or the protocol. This feature is used mainly in firewall applications to filter the packets that could potentially harm the network system or generate unnecessary traffic in the network. Selecting Network > Firewall Configuration brings up the form shown in the following figure. Figure 8-20: Expert > Network > Firewall Configuration You can use the Firewall Configuration form to enable firewall on CS. You can define rules to allow or disallow packets, and configure filtering of packets that are sent and received through CS. Packet filtering relies on defined chains and rules. See Packet Filtering on CS on page 13 for details. 186

217 Network Each entry in the list on the Firewall Configuration form represents a chain with a set of rules. The list by default has three built-in chains, as shown in the previous figure. The chains accept all INPUT, FORWARD, and OUTPUT packets. You can use the Edit, Delete, Add, and Edit Rules buttons on the form to do the following to configure packet filtering: Edit default chains Delete user-added chains Add new chains Edit rules for chains Edit Button Selecting one of the default chains and pressing the Edit button, the Edit Chain dialog box shown in the following figure appears. Figure 8-21: Expert > Firewall Configuration Edit Chain Dialog Box Only the policy can be edited for a default chain. The options are ACCEPT, and DROP. Note: User-defined chains cannot be edited. If a user-defined chain is selected for editing, the message shown in the following figure appears. BLACK BOX CS Installation, Administration, and User s Guide 187

218 Network Menu & Forms Figure 8-22:Firewall Configuration User-defined Chain Message Delete Button If one of the user-defined chains is selected and the Delete button is pressed the chain is deleted. Note: Default chains cannot be deleted. If one of the default chains is selected and the Delete button is pressed the message shown in the following figure appears. Figure 8-23:Firewall Configuration Delete Default Chain Message Add Button If the Add button is pressed under, the Add Chain dialog box shown in the following figure appears. 188

219 Network Figure 8-24:Expert > Firewall Configuration Add Chain Dialog Box Adding a chain only creates a named entry for the chain. Rules must be configured for the chain after it is added to the list of chains. Edit Rules Button If the Edit Rules button is pressed, a form appears with a list of headings like the one shown in the following figure. The example shows the OUTPUT chain selected for editing. Figure 8-25: Firewall Configuration Edit Rules for chain_name Form The buttons shown in the following figure appear at the bottom of the form. BLACK BOX CS Installation, Administration, and User s Guide 189

220 Network Menu & Forms Figure 8-26:Firewall Configuration Edit Rules for chain_name Buttons Pressing the Add button opens the Add Rule dialog box. Selecting a Rule and pressing the Edit button opens the Edit Rule dialog box. Selecting a rule and pressing the Up and Down buttons moves the rule up and down the list. Options on the Add Rule and Edit Rule Dialog Boxes The Add Rule and Edit Rule dialog boxes have the fields and options shown in the following figure. Figure 8-27:Expert > Firewall Configuration Add Rule and Edit Rule Dialog Boxes Inverted Checkboxes If the Inverted checkbox is enabled for the corresponding option, the target action is performed on packets that do not match any of the criteria specified in that line. 190

221 Network For example, you select DROP as the target action from the Target dropdown list, check Inverted on the line with the Source IP, and do not specify any other criteria in the rule, any packets arriving from any other source IP address than the one specified are dropped. Target Pull-down Menu Options The Target pull-down menu shows the action to be performed on an IP packet that matches all the criteria specified in a rule. The kernel can be configured to ACCEPT, DROP, RETURN, LOG or REJECT the packet by sending a message, translating the source or the destination IP address, or sending the packet to another user-defined chain. The default target pull-down menu is shown in the following figure. Figure 8-28:Firewall Configuration Add Rule and Edit Rule Target Menu Options Source or Destination IP and Mask If you add a value in the Source IP field, incoming packets are filtered for the specified IP address, and if you add a value in the Destination IP field, outgoing packets are filtered for the specified IP address. A value in the Mask field, means incoming or outgoing packets are filtered for IP addresses from the network in the specified subnet. The source and destination IP and related fields are shown in the following figure. Figure 8-29:Firewall Configuration Add Rule and Edit Rule Source and Destination IP and Mask Fields BLACK BOX CS Installation, Administration, and User s Guide 191

222 Network Menu & Forms Protocol You can select a protocol for filtering. The Protocol pull-down menu is shown in the following figure. Figure 8-30:Firewall Configuration Add Rule and Edit Rule Protocol Menu Options The additional fields that appear for each protocol are explained in the following sections. Numeric Protocol Fields If Numeric is selected as the protocol when specifying a rule, a text field appears to the right of the menu for the desired number, as shown in the following figure. Figure 8-31:Firewall Configuration Add Rule and Edit Rule Numeric Protocol Fields TCP Protocol Fields If TCP is selected as the protocol when specifying a rule, the additional fields shown in the following figure appear on the bottom of the form. 192

223 Network Field/Menu Option Figure 8-32:Firewall Configuration Add Rule and Edit Rule TCP Protocol Fields and Menu Options The following table defines the fields and menu options in the TCP Options Section. Table 8-13: Expert > TCP Options Fields Definition Source Port - OR - Destination Port -ANDto TCP Flags Inverted A port number for filtering in the Source Port or Destination Port field. A range of IP address can be specified by adding a second port number in the to field. TCP packets are filtered for for the range of specified IP addresses. The TCP flags cause packets to be filtered for the specified flag and the selected condition. The flags are: SYN (synchronize), ACK (acknowledge), FIN (finish), RST (reset), URG (urgent) or PSH (push), and the conditions are either Any, Set, or Unset. By checking this box, The TCP options are "Inverted". "Inverting" an item negates the selected rules. Rules will apply to everything except the selected options. UDP Protocol Fields If UDP is selected as a protocol when specifying a rule, the additional fields shown in the following figure appear at the bottom of the form. BLACK BOX CS Installation, Administration, and User s Guide 193

224 Network Menu & Forms Figure 8-33:Firewall Configuration Add Rule and Edit Rule UDP Protocol Fields The following table defines the fields in the UDP Options Section. Table 8-14: Expert > UDP Options Fields Field Source Port - OR - Destination Port -ANDto Inverted Definition A port number for filtering in the Source Port or Destination Port field. A range of IP address can be specified by adding a second port number in the to field. TCP packets are filtered for for the range of specified IP addresses. By checking this box, The UDP options are "Inverted". "Inverting" an item negates the selected rules. Rules will apply to everything except the selected options. ICMP Protocol Fields If ICMP is selected as a protocol, the ICMP Type pull-down menu appears in the ICMP Options Section at the bottom of the Firewall Configuration form. The following figure shows the options. 194

225 Network Figure 8-34:Firewall Configuration Add Rule and Edit Rule ICMP Type Menu Options BLACK BOX CS Installation, Administration, and User s Guide 195

226 Network Menu & Forms Input Interface, Output Interface, and Fragments If an interface (such as eth0 or eth1) is entered in the Input Interface field, incoming packets are filtered for the specified interface. If an interface is entered in the Output Interface field, outgoing packets are filtered for the specified interface. The input and output interface fields are shown in the following figure along with the options on the Fragments pull-down menu. Figure 8-35:Firewall Configuration Input and Output Interface Fields and Fragments Menu Options The following table defines the fields in the above figure. Table 8-15: Expert > Firewall Configuration Input and Output Interface, and Fragments Fields Definitions. Field Definition Input Interface Output Interface Inverted Fragments The input interface (ethn) for the packet The output interface (ethn) for the packet "Inverting" an item negates the selected rules. Rules will apply to everything except the selected options. The types of packets to be filtered: All packets 2nd, 3rd... fragmented packets Non-fragmented and 1st fragmented packets 196

227 Network LOG Target If you select LOG from the Target field, the fields and menus shown in the following figure appear in the LOG Options Section at the bottom of the form. Figure 8-36:Firewall Configuration Add Rule and Edit Rule LOG Target Fields The following table defines the menu options and fields in the LOG Options Section. Table 8-16: Expert > Target LOG Options Selection Fields Field or Menu Name Definition Log Level One of the options in the pull-down menu: Log Prefix TCP Sequence TCP Options IP Options The prefix is included in the log entry. Includes the TCP sequence in the log. Includes TCP options in the log. Includes IP options in the log. BLACK BOX CS Installation, Administration, and User s Guide 197

228 Network Menu & Forms REJECT Target If REJECT is selected from the Target pull-down menu, the following pulldown menu appears Figure 8-37:Firewall Configuration Add Rule and Edit Rule REJECT Target Menu Options Any Reject with option causes the input packet to be dropped and a reply packet of the specified type to be sent. Table 8-17: Expert > Reject Options Sections Field Name Reject with icmp-netunreachable icmp-hostunreachable icmp-portunreachable icmp-protounreachable Definition Reject with means that the filter will drop the input packet and send back a reply packet according to any of the reject types listed below. ICMP network unreachable alias. ICMP host unreachable alias. ICMP port unreachable alias. ICMP protocol unreachable alias. 198

229 Network Table 8-17: Expert > Reject Options Sections Field Name icmp-net-prohibited icmp-hostprohibited echo-reply tcp-reset Definition ICMP network prohibited alias. ICMP host prohibited alias. Echo reply alias. TCP RST packet alias. Note: The packets are matched (using tcp flags and appropriate reject type) with the REJECT target. Firewall Configuration Procedures The following sections describe the procedures for defining packet filtering: To Add a Chain 1. Go to Network > Firewall Configuration. 2. Click Add. The Add Chain dialog box appears. 3. Enter the name of the chain to be added in the Name field and then click OK. Note: Spaces are not allowed in the chain name. The name of the new chain appears in the list. 4. Finish defining the chain by adding one or more rules, as described in "To Add a Rule" To Edit a Chain Perform this procedure if you want to change the policy for a default chain. BLACK BOX CS Installation, Administration, and User s Guide 199

230 Network Menu & Forms Note: User-defined chains cannot be edited. If you want to rename a chain you added, delete it and create a new one. 1. Go to Network > Firewall Configuration 2. Select one of the default chains from Chain list, and then click the Edit button. If you select a user-defined chain, the dialog box shown in the following figure appears. If you select one of the default chains, the Edit Chain dialog box appears. 3. Select the desired policy from the Policy pull-down menu, and then click OK. 4. Click apply changes. 5. To edit any rules for this chain, go to "To Edit a Rule" To Add a Rule 1. Go to Network > Firewall Configuration 200

231 Network 2. Select the chain to which you want to add a rule from Chain list, and then click the Edit Rules button. 3. Click the Add Rule button. The Add Rule dialog box appears. 4. Configure the rule as desired. For definitions of the fields in this form see Firewall Configuration on page Click OK. 6. Click apply changes. To Edit a Rule 1. Go to Network > Firewall Configuration 2. Select the chain that you want to edit from the list and click the Edit Rules button. The Edit Rules form appears. 3. Select the rule to be edited from the Rules list, and then click the Edit button. The Edit Rule dialog box appears. 4. Modify the rule as desired. For definitions of the fields in this form see Firewall Configuration on page Click OK. 6. Click apply changes. Host Table The Host Table form enables you to keep a table of host names and IP addresses that comprise your local network, and provide information on your environment. Selecting Network > Host Tables brings up the form shown in the following figure. BLACK BOX CS Installation, Administration, and User s Guide 201

232 Network Menu & Forms Figure 8-38: Expert > Network > Host Tables To Define the CS s IP Address and Hostname 1. Go to Network > Host Tables The Host Tables form appears. 2. To edit a host, select the host IP address from the list and click the Edit button. (You can use the Up and Down buttons to navigate through the list.) 3. To add a host, click the Add button. The host table dialog box appears. 4. Enter the new or modified host address in the IP Address field, and the host name in the Name field, and then click OK. 5. To delete a host, select the host you wish to delete and click Delete. 6. Click apply changes. Static Routes The Static Routes form allows you to manually add routes. The Routing Table defines which interface should transmit an IP packet based on destination IP information. Static routes are a quick and effective way to route data from one subnet to another. Selecting Network > Static Routes brings up the form shown in the following figure. 202

233 Network Figure 8-39: Expert > Network > Static Routes Clicking the Edit or Add buttons brings up a form shown in the following figure. Figure 8-40: Expert > Static Routes Add and Edit Dialog Boxes - Default Route The example shows the fields and menus that appear when the Default route type is selected from the Route pull-down menu. BLACK BOX CS Installation, Administration, and User s Guide 203

234 Network Menu & Forms The following figure shows the fields and menus that appear when the Network route type is selected from the Route pull-down menu. Figure 8-41: Expert > Static Routes Add and Edit Dialog Boxes - Network Route The following figure shows the fields and menus that appear when the Host route type is selected from the Route pull-down menu. 204

235 Network Figure 8-42: Expert > Static Routes Add and Edit Dialog Boxes - Host Route The following table describes the fields that appear when you select a routing type from the New/Modify Route dialog boxes. Table 8-18: Expert > Fields and Menus for Configuring Static Routes Field or Menu Name Route Network IP Network Mask Host IP Go to [Adjacent field] Metric Definition Choices are Default, Network, or Host. Appears only when Network route is selected. Type the IP address of the destination network. Appears only when Network route is selected. Type the netmask of the destination network. Appears only when Host route is selected. Type the IP address of the destination host. Choices are Gateway or Interface. Type the IP address of the gateway or the name of the interface. Type the number of hops to the destination. To Configure Static Routes [Expert] See Table 8-17 on page 198 for the field descriptions. 1. Go to Network > Static Routes The Static Routes form appears. To edit a static route, select a route from the Static Routes list, and then select the Edit button. To add a static route, select the Add button from the form. The system invokes the New/Modify Route dialog box. 2. Choose Default, Network, or Host from the Route pull-down menu. BLACK BOX CS Installation, Administration, and User s Guide 205

236 Network Menu & Forms 3. If you selected Network, do the following steps. a. Enter the IP address of the destination network in the Network IP field. b. Enter the netmask of the destination network in the Network Mask field. 4. If you selected Host, type the IP address of the destination host in the Host IP field. 5. Select Gateway or Interface from the Go to pull-down menu and enter the address of the gateway or the name of the interface in the adjacent field. 6. Click apply changes. 206

237 Chapter 9 Security Menu & Forms This Chapter describes the Security menu and the related forms. The following table provides a description of the left menu panel and links to the detailed information and procedures. Table 9-1: Expert > Security Menu Menu Selection Use this menu to: Where Documented Users and Groups Active Port Sessions Authentication Security Profiles Create or edit users and groups, establish or change their passwords, and access rights and privileges. Show the active sessions, as well as their identifications, features and usage statistics. Enter the authentication method used to access CS. Select a pre-defined Security Profile, or choose Custom Profile to configure individual settings. Page 208 Page 212 Page 214 Page 226

238 Security Menu & Forms Users and Groups Users and Groups form allows you to do the following tasks: Set up user access to the CS Web Manager Assign users to specific groups that share common access rights Assign or change passwords Create new groups and add to the group list. The two groups to which you can assign a user are: Admin - Read/Write Access Regular User - Limited Read/Write Access Caution: There is only one root user for the initial setup of the CS by the administrator. The username is root, and the default password is bb. For security purposes make sure you change this default password as soon as possible! Selecting Security > Users & Groups in Expert mode brings up the form shown in the following figure. Figure 9-1: Expert > Security > Users and Groups Form You can use the Users and Groups form to do the following: Add or delete users Assign or change user passwords Add or delete groups 208

239 Add users to a group Delete users from a group Adding a User If you click the Add button on the Security > Users and Groups form under the Users List, the following dialog box appears. Figure 9-2: Expert > Security > Users and Groups > Add User Dialog Box The following table describes the fields in the Add User dialog box. Table 9-2: Expert > Add User Dialog Field Names and Definitions Field Name User Name Password Group Definition Name of the user to be added. The password associated with the user name. On the Group pull-down menu, select Regular User [Default] or Admin. Note: To configure a user to be able to perform all administrative functions, select the Admin group. BLACK BOX CS Installation, Administration, and User s Guide 209

240 Security Menu & Forms Table 9-2: Expert > Add User Dialog Field Names and Definitions Field Name Shell Comments Definition Optional. The default shell is /bin/sh when the user makes an SSH or Telnet connection. Optional notes about the user s role or configuration. Adding a Group If you click the Add button on the Security > Users and Groups form under the Group List, the following dialog box appears. Figure 9-3: Expert > Security > Users and Groups > Add Group Dialog Box You can add a new group by entering a group name and a comma-separated list of users. To Add a User 1. Go to Security > Users and Groups The Users and Groups form displays. 2. Click Add. The Add User dialog box displays. 210

241 3. Enter the name in the User Name field. 4. Enter the password in the Password and Repeat Password fields. 5. Assign a group from the Group pull-down menu. 6. Optional: Select a shell from the Shell pull-down menu. 7. Optional: Enter information, as desired, about the user s role or responsibilities. 8. Click OK. 9. Click apply changes. To Delete a User or Group 1. Go to Security > Users and Groups The Users & Groups form displays. 2. Select the name of a user or group to delete. 3. Click Delete. 4. Click apply changes. To Change a User s Password 1. Go to Security > Users and Groups The Users and Groups form displays. 2. Select the name of the user whose password you want to change. 3. Click Change Password. The Change User Password dialog box displays. 4. Enter the new password in the New Password field and enter it again in the Repeat New Password field. 5. Click OK. 6. Click apply changes. To Add a Group 1. Go to Security > Users and Groups BLACK BOX CS Installation, Administration, and User s Guide 211

242 Security Menu & Forms The Users & Groups form displays. 2. Under the list of groups, click Add. The Add Group dialog box displays. 3. Enter the name for the new group in the Group Name field. 4. Enter one user name or multiple comma-separated user names in the Users field. 5. Click OK. 6. Click apply changes. To Modify a Group 1. Go to Security > Users and Groups The Users and Groups form displays. 2. Select the name of a group to modify. 3. Click Edit. The Edit Group form displays. 4. Add or delete users from the group as desired. 5. Click OK. 6. Click apply changes. Active Ports Sessions Selecting Security > Active Ports Sessions brings up the form shown in the following figure. 212

243 Figure 9-4: Expert > Security > Active Ports Sessions The Active Ports Sessions form provides status and usage information related to all active serial ports sessions. You can use the form to view who is logged into each port and the processes they are running. Open sessions are displayed with their identification and statistical data, the related data such as CPU usage for a specific client, JCPU processes, and PCPU processing time. The Kill Sessions and Refresh buttons either end or refresh the selected session. The following table defines the active ports sessions form fields. Table 9-3: Expert > Active Ports Sessions Information. Field Name Definition User TTY From Login Idle First eight characters of the username. Connection method. Where the network connection is from. Login time in hours and minutes. If login was not on the same day, the date of login also appears. How long since last activity. BLACK BOX CS Installation, Administration, and User s Guide 213

244 Security Menu & Forms Field Name JCPU PCPU What Definition The amount of CPU time consumed by all active processes including currently running background jobs. The amount of CPU time consumed by the current process. Name of the current process. To View, Kill, or Refresh Active User Sessions 1. Go to Security > Active Ports Sessions in Expert mode. The Active Ports Sessions form appears. 2. To refresh the display, click the Refresh button. If you are using this form to view the information you are done. 3. To kill a session, select the desired session and click the Kill Sessions button. Authentication Selecting Security > Authentication brings up the form shown in the following figure, which is comprised of six tabs. 214

245 Figure 9-5: Expert > Security > Authentication You can use the Authentication forms to: Select a method for authenticating logins to CS. Identify authentication servers that are configured for logins to CS or to the serial ports. Configuring Authentication for CS Logins The default authentication method for CS is Local. You can either accept the default or select another authentication method from the Unit Authentication pull-down menu on the AuthType form. BLACK BOX CS Installation, Administration, and User s Guide 215

246 Security Menu & Forms Figure 9-6: Expert > Security > Authentication > AuthType Form Any authentication method selected for CS is used for authentication of any user attempting to log into the CS through Telnet, SSH, or the Web Manager. To Configure the CS Login Authentication Method 1. Go to Security > Authentication. The AuthType form displays, as shown in the figure To specify an authentication method for login to CS, select a method from the Unit Authentication pull-down menu. 3. Click apply changes. 4. Make sure an authentication server is specified for the selected authentication type. Configuring Authentication Servers for Logins to CS and Connected Devices If you are configuring any authentication method other than Local, make sure an authentication server is set up for that method. 216

247 The following is a summary of the things you need to know about setting up authentication servers. CS must be on the same subnet as the authentication server. Each authentication server must be configured and operational. The CS administrator should obtain the necessary information from each authentication server administrator, in order set up and identify those servers on CS. For example, if LDAP authentication were to be used for logins to CS and Kerberos for logins to serial ports, then CS needs to have network access to an LDAP and a Kerberos authentication server. The administrator needs to perform setup on CS for both types of authentication servers. The administrator completes the appropriate form through the Web Manger Expert > Security > Authentication to setup an authentication server for every authentication method to be used by CS and its ports. The following table lists the procedures that apply to each authentication method. Table 9-4: Tasks for Setting up Authentication Servers. Method Variations Procedures RADIUS TACACS+ LDAP Kerberos RADIUS, Local/RADIUS, RADIUS/ Local, or RADIUS/DownLocal TACACS+, Local/TACACS+, TACACS+/Local, or TACACS+/ DownLocal LDAP, LDAP/Local, or LDAPDownLocal Kerberos, Kerberos/Local, or KerberosDownLocal See To Configure a RADIUS Authentication Server on page 218 See To Configure a TACACS+ Authentication Server on page 219 See To Configure an LDAP Authentication Server on page 221 See To Configure a Kerberos Authentication Server on page 223 BLACK BOX CS Installation, Administration, and User s Guide 217

248 Security Menu & Forms Table 9-4: Tasks for Setting up Authentication Servers. Method Variations Procedures NIS NIS, Local/NIS, NIS/Local, or NISDownLocal See To Configure a NIS Authentication Server on page 225 To Configure a RADIUS Authentication Server Perform the following procedure to configure a RADIUS authentication server when CS or any of its ports are configured to use RADIUS authentication method or any of its variations (Local/RADIUS, RADIUS/ Local, or RADIUS/DownLocal). 1. Go to Security > Authentication > RADIUS in Expert mode. The RADIUS form displays as shown in the following figure. Figure 9-7: Expert > Security > Authentication > Radius 2. Fill in the form according to your local RADIUS server configuration. 3. Click apply changes. The changes are stored in /etc/raddb/server on CS. 218

249 Group Authorization on RADIUS Group information retrieval from a RADIUS authentication server adds another layer of security by adding a network-based authorization. It retrieves the group information from the authentication server and performs an authorization through CS. To see the configuration procedures for a RADIUS authentication server refer to the CS Command Reference Guide, Chapter 3, Section 3.4 Group Authorization. To Configure a TACACS+ Authentication Server Perform the following procedure to configure a TACACS+ authentication server when CS or any of its ports are configured to use TACACS+ authentication method or any of its variations (Local/TACACS+, TACACS+/ Local, or TACACS+/DownLocal). 1 Go to Security > Authentication > TACACS+ in Expert mode. The TACACS+ form appears as shown in the following figure. Figure 9-8: Expert > Security > Authentication > TACACS+ BLACK BOX CS Installation, Administration, and User s Guide 219

250 Security Menu & Forms 2 Fill in the form according to your local TACACS+ server configuration. 3 To apply Authorization in addition to authentication to the box and ports, select the Enable Raccess Authorization check box. By default Raccess Authorization is disabled, and no additional authorization is implemented. When Raccess Authorization is enabled, the authorization level of users trying to access CS or its ports using TACACS+ authentication is checked. Users with administrator privileges have administrative access, and users with regular user privileges have regular user access. 4 To specify a time out period in seconds for each authentication attempt, type a number in the Timeout field. If the authentication server does not respond to the client s login attempt before the specified time period, the login attempt is cancelled. The user may retry depending on the number specified in the Retries field on this form. 5 To specify a number of times the user can request authentication verification from the server before sending an authentication failure message to the user, enter a number in the Retries field. 6 Click apply changes. The changes are stored in /etc/tacplus.conf on the CS. Group Authorization on TACACS+ Using an authorization method in addition to authentication provides an extra level of system security. Selecting Security > Authentication > TACACS+ in Expert mode brings up the TACACS+ form where an administrators can configure a TACACS+ authentication server and can also enable user authorization checking. By checking the Enable Raccess Authorization check box, an additional level of security checking is implemented. After each user is successfully authenticated through the standard login procedure, the CS uses TACACS+ to authorize whether or not each user is allowed to access specific serial ports. By default the Enable Raccess Authorization is disabled allowing all users full authorization. When this feature is enabled by placing a check mark in the box, users are denied access unless they have the proper authorization, which must be set on the TACACS+ authentication server itself. To see the 220

251 configuration procedures for a TACACS+ authentication server refer to the CS Command Reference Guide, Chapter 3, Section 3.4 Group Authorization. To Configure an LDAP Authentication Server Perform the following procedure to configure an LDAP authentication server when the CS or any of its ports are configured to use the LDAP authentication method or any of its variations (LDAP, LDAP/Local, or LDAPDownLocal). Before starting this procedure, find out the following information from the LDAP server administrator: The distinguished name of the search base The LDAP domain name Whether to use secure LDAP The authentication server s IP address You can enter information in the following fields, but an entry is not required: LDAP User Name LDAP Password LDAP Login Attribute Work with the LDAP server administrator to ensure that the following types of accounts are set up on the LDAP server and that the administrators of the CS and the connected devices know the passwords assigned to the accounts: An account for admin If LDAP authentication is specified for the CS, accounts for all users who need to log into the CS to administer connected devices. If LDAP authentication is specified for serial ports, accounts for users who need administrative access to the connected devices. 1. Go to Security > Authentication > LDAP in Expert mode. The LDAP form displays with LDAP Server and LDAP Base fields filled in from with the current values in the /etc/ldap.conf file. BLACK BOX CS Installation, Administration, and User s Guide 221

252 Security Menu & Forms Figure 9-9: Expert > Security > Authentication > LDAP 2. Supply the IP address of the LDAP server in the LDAP Server field. 3. If the LDAP authentication server uses a different distinguished name for the search base than the one displayed in the LDAP Base field, change the definition. The default distinguished name is dc, as in dc=value,dc=value. If the distinguished name on the LDAP server is o, then replace dc in the base field with o, as in o=value,o=value. 4. Replace the default base name with the name of your LDAP domain. For example, for the LDAP domain name blackbox.com, the correct entry is: dc=blackbox,dc=com. 5. Enable Secure LDAP, if required. 6. Enter optional information in LDAP User Name, LDAP Password, and LDAP Login Attribute fields. 7. Click apply changes. The changes are stored in /etc/ldap.conf on the CS. Group Authorization on LDAP Group information retrieval from an LDAP authentication server adds another layer of security by adding a network-based authorization. It retrieves the group information from the authentication server and performs an 222

253 authorization through CS. To see the configuration procedures for an LDAP authentication server refer to the CS Command Reference Guide, Chapter 3, Section 3.4 Group Authorization. To Configure a Kerberos Authentication Server Perform the following procedure to configure a Kerberos authentication server when CS or any of its ports is configured to use Kerberos authentication method or any of its variations (Kerberos, Kerberos/Local, or KerberosDownLocal). Before starting this procedure, find out the following information from the Kerberos server s administrator: Realm name and KDC address Host name and IP address for the Kerberos server Also, work with the Kerberos server s administrator to ensure that following types of accounts are set up on the Kerberos server and that the administrators of the CS and connected devices know the passwords assigned to the accounts: An account for admin If Kerberos authentication is specified for CS, accounts for all users who need to log into the CS to administer connected devices. If Kerberos authentication is specified for the serial ports, accounts for users who need administrative access to connected devices 1. Make sure an entry for the CS and the Kerberos server exist in the CS s / etc/hosts file. a. Go to Network > Host Table in Expert mode. The Host Table form appears. b. Add an entry for CS if none exists and an entry for the Kerberos server. i. Click Add. The New/Modify Host dialog appears. ii. Enter the address in the IP Address field. iii. Enter the name in the Name field. BLACK BOX CS Installation, Administration, and User s Guide 223

254 Security Menu & Forms iv. Enter an optional alias in the Alias field. 2. Make sure that time, date, and timezone settings are synchronized on the CS and on the Kerberos server. Note: Kerberos authentication depends on time synchronization. Time and date synchronization can be achieved by setting both CS and the Kerberos server to use the same NTP server. a. To specify an NTP server, see To Configure Time and Date Using an NTP Server on page 306. b. To manually set the time and date on the CS, see To Manually Set the Time and Date on page 306. c. Work with the Kerberos authentication server administrator to synchronize the time and date between CS and the Kerberos server. 3. Set the timezone on CS by going to Administration > Time/Date in Expert mode as per the following figure. The default is GMT. Figure 9-10: Expert > Administration > Time/Date 4. Go to Security > Authentication> Kerberos in Expert mode. The Kerberos form displays as shown in the following figure. 224

255 Figure 9-11:Expert > Security > Authentication > Kerberos 5. Fill in the form according to your local setup of the Kerberos server. 6. Click apply changes. To Configure a NIS Authentication Server Perform the following procedure to configure a NIS authentication server when CS or any of its ports is configured to use NIS authentication method or any of its variations (Local/NIS, NIS/Local, or NISDownLocal). 1. Go to Security > Authentication > NIS in Expert mode. The NIS form displays as shown in the following figure. BLACK BOX CS Installation, Administration, and User s Guide 225

256 Security Menu & Forms Figure 9-12:Expert > Security > Authentication > NIS 2. Fill in the form according to your configuration of the NIS server. 3. Click apply changes. Security Profiles Selecting Security > Security Profile brings up the form shown in the following figure. Figure 9-13: Expert > Security > Security Profile 226

257 A Security Profile consists of a set of parameters that can be configured in order to have more control over the services that are active at any time. Pre-defined Security Profiles There are three pre-defined security profiles: 1. Secure - The Secure profile disables all protocols except SSHv2, HTTPS, and SSH to Serial Ports. Authentication to access Serial Ports is required, and SSH root access is not allowed. Note: SSH root access is enabled when the security profile is set to Moderate or Open. If a Secure security profile is selected, you need to switch to a Custom security profile, and enable allow root access option. 2. Moderate - The Moderate profile is the recommended security level. This profile enables SSHv1, SSHv2, HTTP, HTTPS, Telnet, SSH and Raw connections to the Serial Ports. In addition, ICMP and HTTP redirection to HTTPS are enabled. Authentication to access the serial ports is not required. 3. Open - The Open profile enables all services such as Telnet, SSHv1, SSHv2, HTTP, HTTPS, SNMP, RPC, ICMP, and Telnet, SSH and Raw connections to the Serial Ports. Authentication to access serial ports is not required. Default Security Profile The Default Security Profile sets the parameters to same as Moderate profile. See the following tables for the list of enabled services when the Default security profile is used. Custom Security Profile The Custom Security Profile opens up a dialog box to allow custom configuration of individual protocols or services. Note: By default, a number of protocols and services are enabled in the Custom profile, however, they are configurable to user s custom requirements. BLACK BOX CS Installation, Administration, and User s Guide 227

258 Security Menu & Forms The following tables illustrate the properties for each of the Security Profiles. The enabled services in each profile is designated with a check mark. Table 9-5: Expert > Enabled services to access the CS under each security profile. Access to CS Secure Moderate Open Default 1 Custom Telnet SSHv1 SSHv2 Allow SSH root access HTTP HTTPS User Configurable HTTP redirection to HTTPS 1-The Default security profile parameters is the same as Moderate profile. Table 9-6: Expert > Enabled services to access the serial ports under each security profile. Access to Serial Ports Secure Moderate Open Default 1 Custom Console (Telnet) Console (SSH) Console (Raw) Serial Port Authentication Bidirect (Dynamic Mode Support) User Configurable 1-The Default security profile parameters is the same as Moderate profile. 228

259 Table 9-7: Expert > Enabled protocols for each security profile shown with a check mark. Other Services Secure Moderate Open Default 1 Custom SNMP RPC ICMP FTP IPSec User Configurable 1-The Default security profile parameters is the same as Moderate profile. The first step in configuring your Advanced Console Server is to define a Security Profile. One of the following situations is applicable when you boot up the CS unit. 1. CS is starting for the first time, or after a reset to factory default parameters. In this situation when you boot CS up and login as an administrator to the Web Manager, a security warning dialog box appears. The Web Manager is redirected to Step1: Security Profile in the Wizard mode. Further navigation to other sections of the Web Manager is not possible without selecting or configuring a Security Profile. Once you select or configure a Security Profile and save the changes CS restarts. 2. CS firmware is upgraded and the system is restarting with the new firmware. In this situation the CS was already in use and certain configuration parameters were saved in the flash memory. In this case CS automatically retrieves the Custom Security Profile parameters saved in the flash memory and behaves as it was a normal reboot. 3. CS is restarting normally. In this situation the system detects the pre-defined security profile. You can continue working in the Web Manager. BLACK BOX CS Installation, Administration, and User s Guide 229

260 Security Menu & Forms Serial Port Settings and Security Profiles All serial ports on CS units shipped from the factory are disabled by default. The administrator can enable ports individually or collectively and assign specific users to individual ports. The following figure shows the default factory settings of serial ports. Figure 9-14: Expert > Physical Ports Default Factory Settings The following situations apply to serial ports when you modify or change a security profile. If you reconfigure the security profile and restart the Web manager, you need to make sure the serial ports protocols and access methods match the selected security profile. The following reminder dialog box appears when you access Ports in Expert mode. Figure 9-15:Security Profile and Serial Ports Configuration Alert 230

261 If the serial port connection protocol is incompatible with the selected security profile the following dialog box appears when you try to access Expert > Ports > Physical Ports Figure 9-16:Serial Ports Protocol Incompatibility Dialog Box To Select or Configure a Security Profile The following procedure assumes you have installed a new CS at your site, or you have reset the unit to factory default. 1. Enter the assigned IP address of the CS in your browser and login as an administrator. The following security warning dialog box appears. BLACK BOX CS Installation, Administration, and User s Guide 231

262 Security Menu & Forms Figure 9-17: Security Advisory Dialog Box Note: Your browser s pop-up blocker should be disabled for this dialog box to appear. 2. Review the Security Advisory and click the Close button. 3. The Web Manager is redirected to Wizard > Step 1: Security Profile The following form is displayed. 232

263 Figure 9-18:Wizard > Step 1: Security Profile Form 4. Select a pre-defined Security Profile by pressing one of the Secured, Moderate, Open, or Default profiles, or create a Custom profile. The following dialog box appears when you select the Custom profile. BLACK BOX CS Installation, Administration, and User s Guide 233

264 Security Menu & Forms Figure 9-19: Custom Security Profile Dialog Box Caution: Take the required precautions to understand the potential impacts of each individual service configured under the "Custom" profile. Refer to Table 9-5 on page 228, and the subsequent tables for a comparison of the available services in each security profile. Refer to the Glossary for a definition on some of the available services. 234

265 Note: It is not possible to continue working in the Web Manager without selecting a Security Profile. The following dialog box appears if you try to navigate to other sections of the Web Manager. 5. Once you select a security profile or configure a custom profile and apply the changes, the CS Web Manager restarts in order for the changes to take effect. The following dialog box appears. 6. Select apply changes to save the configuration to Flash. CS Web Manager restarts. 7. Login after Web Manager restarts. 8. The Web Manager defaults to Ports > Ports Status page. Proceed to the desired forms and the related tasks outlined in the table below. Table 9-8: Configuring CS in Expert Mode Configure Users and Groups Users and Groups on page 208 Configure Serial Ports Physical Ports on page 239 Configure Network Settings Host Settings on page 152 Configure IPDU Power Management IPDU Power Mgmt. on page 120 BLACK BOX CS Installation, Administration, and User s Guide 235

266 Security Menu & Forms Security Certificates CS generates its own self-signed SSL certificate for HTTPS using OpenSSL. Note: It is highly recommended that you use the openssl tool to replace the CS generated certificate. Certificate for HTTP Security A certificate for HTTP security is created by a CA (Certificate Authority). Certificates are most commonly obtained through generating public and private keys using a public key algorithm like RSA or X.509. The keys can be generated by using a key generator software. The procedures to obtain a Signed Digital Certificate is documented in the CS Command Reference Guide, Chapter 3 Authentication, Section 3.7 Certificate for HTTP Security. User Configured Digital Certificate You can generate a self-signed digital certificate. It is highly recommended that you use the openssl tool to generate a self-signed certificate and replace the CS generated certificate.the procedures to configure a self-signed digital certificate is documented in the CS Command Reference Guide, Chapter 3 Authentication, Section 3.8 User Configured Digital Certificate X.509 Certificate on SSH The OpenSSH software included with CS has support for X.509 certificates. The administrator must activate and configure the SSH to use X.509. In order to implement authentication of SSH sessions through exchange of X.509 certificates please refer to the configuration procedures described in the CS Command Reference Guide, Chapter 3 Authentication, Section 3.8 X.509 Certificate on SSH. 236

267 Chapter 10 Ports Menu & Forms This Chapter describes the Ports menu and the related forms. The following table provides a description of the left menu panel in the Web Manager and links to the detailed information and procedures. Table 10-1: Expert > Ports Menu Menu Selection Use this menu to: Where Documented Physical Ports Virtual Ports Port Status Activate or deactivate the serial ports. Set the parameters for each or all ports. Configure specific parameters for the serial ports where IPDU devices are connected. Perform Clustering. This section shows how to define and configure slaves. One CS can be used as a Master to control other CS (slaves) units. All ports of the slave unit appear as if they are part of the master unit. View the current status of each port. The information provided here are RS232 Signal Status and user connected to each port. Page 239 Page 281 Page 287

268 Ports Menu & Forms Menu Selection Use this menu to: Where Documented Ports Statistics View information on the data reception (Rx bytes) and transmission (Tx bytes) on each physical port. View current CAS user(s), Baud rate, frame, parity, break, and overruns. Page 288 The Ports section of CS configuration in Expert Mode provides the following menu choices: Physical Ports Allows you to view and modify the physical port settings. Virtual Ports Allows you to view and modify the slave port settings. Ports Status Allows you to view ports connection status. Ports Statistics Allows you to view serial ports connection statistics. Selecting Ports in Expert mode brings up the form shown in the following figure. Figure 10-1: Expert > Ports 238

269 Using the forms described in the following sections, you can perform custom configuration of serial ports. Physical Ports When Physical Ports is selected under Ports > Physical Ports in Expert mode, the following form appears. Figure 10-2: Expert > Ports > Physical Ports Using this form you can enable or disable ports, and configure parameters for individual or a group of serial ports. You can select contiguous serial ports on the form by using the [Shift] key, or non-contiguous ports by using the [Ctrl] key on your keyboard. You can Enable Selected Ports or Disable Selected Ports by pressing the corresponding button. You can select the Modify All Ports button to specify the same parameters for all the serial ports, or you can select Modify Selected Ports button, and set values for an individual or a group of ports. Selecting Modify Selected Ports or Modify All Ports option brings up a form with the following six BLACK BOX CS Installation, Administration, and User s Guide 239

270 Ports Menu & Forms tabs Figure 10-3: Expert > Ports > Physical Ports > Modify... Ports Tab Options To Select One or More Serial Ports 1 Go to Ports > Physical Ports in Expert mode The Physical Ports form appears. 2 To select a port or ports, do one of the following steps. To select a single port, click the port. To select multiple ports in a range, click the first port in the list and then hold down the Shift key while selecting another port or ports. To select multiple ports that are not in a range, click the first port in the list, and then hold down the Ctrl key while selecting another port. 3 Go to the desired procedure from the following list. To Configure a Serial Port Connection Protocol for a Console Connection Page 246 To Configure User Access to Serial Ports Page 261 To Configure Data Buffering for Serial Ports Page

271 To Configure Multiple Sessions and Port Sniffing for One or More Serial Ports Page 270 To Configure a Serial Port for IPDU or IPMI Power Management Page 274 To Configure a User for IPDU Power Management While Connected To a Serial Port To Configure TCP Port Number, STTY Options, Break Interval, and the Login Banner for a Serial Port Connected to a Console Page 276 Page 279 To Enable or Disable Serial Ports 1 Go to Ports > Physical Ports, and select a port or ports to modify. 2 To enable selected ports, click the Enable Selected Ports button. 3 To disable selected ports, click the Disable Selected Ports button. Note: By default, all Serial Ports are disabled from the factory. The Administrator can activate and assign specific users to individual physical ports. 4 Click apply changes. General Under Ports > Physical Ports in Expert Mode, if you select one or more ports from the ports list and click the Modify button, the General form appears as shown in the following form. BLACK BOX CS Installation, Administration, and User s Guide 241

272 Ports Menu & Forms Figure 10-4: Expert > Ports > Physical Ports > General Form The General form allows you to define general port settings, connect to an IPDU port, and select the connection type to a serial port (SSH, Telnet, or both). The number(s) of the selected port(s) displays next to the Done button at the bottom of the form in the format: Selected ports #:N, where N stands for the port number. Connection Profiles The following sections describe the available connection protocols for each connection profile to the serial ports. Console Access Server (CAS) Page 243 Terminal Server (TS) Page 243 Bidirectional Telnet Page 245 Modem (RAS) Page 246 Power Management Page

273 Console Access Server (CAS) Profile Connection Protocols When a serial port is connected to the console port on a device, a Console Access Server (CAS) profile must be defined for the serial port. Selecting the appropriate connection protocol on the Ports > Physical Ports > General is part of defining the CAS profile. The CAS connection protocols apply in the following cases: When a user access the serial port through the Web Manager, the session automatically uses the specified protocol to connect to the console of the connected device. When a user logs in remotely to the serial port, access is allowed only for the selected protocol. If another protocol is used then access is denied. For example, if you specify the Console (SSH) protocol, the user can use SSH but cannot use Telnet to access the serial port. The following table shows the options from the list of connection protocols when CS serial port is connected to the console port of a server or a device. Table 10-2: Expert > Console Connection Protocols Protocol Name Console (Telnet) Console (SSH) Console (TelnetSSH) Console (Raw) Result Authorized users can use Telnet to connect to the console of the connected device. Authorized users can use SSH to connect to the console of the connected device. Authorized users can use Telnet and/or SSH to connect to the console of the connected device simultaneously. When multiple sessions feature is configured, simultaneous Telnet and/or SSH sessions are allowed through the serial port. Authorized users can make a Raw Socket connection to the console of the connected device. Terminal Server (TS) Profile Connection Protocols When a computer terminal is connected to the console port on a device, a Terminal Server (TS) profile must be defined for the serial port. BLACK BOX CS Installation, Administration, and User s Guide 243

274 Ports Menu & Forms Selecting the appropriate connection protocol on the Ports > Physical Ports > General form is part of defining the TS profile. You can configure serial ports to support computer terminals in the following two ways: Dedicate a terminal to access a single remote server by means of either Telnet, SSHv1, SSHv2, or Raw Socket connections. Enable a terminal to access multiple servers through CS. The TS profile must specify the TCP port number, the terminal type, and the IP address for the remote host on the Ports > Physical Ports > Other form. The following table describes the connection protocols that can be selected if a terminal is connected to the selected serial port. Table 10-3: Expert > Terminal Server (TS) Connected Protocols Protocol Name Telnet SSHv1 SSHv2 Result Dedicates a computer terminal that is connected to a serial port to access a server using the Telnet protocol. When the attached terminal is powered on, CS opens a Telnet session on the server. The server s IP address should be specified on the Other form, Ports > Physical Ports > Other. Dedicates a computer terminal that is connected to the selected serial port to access a server using the SSHv1 protocol. When the attached terminal is powered on, the CS opens an SSHv1 session on the server. The server s IP address should be specified on the Other form, Ports > Physical Ports > Other. Dedicates a computer terminal that is connected to the selected serial port to access a server using the SSHv2 protocol. When the attached terminal is powered on, the CS opens a SSHv2 session on the server. The server s IP address should be specified on the Other form, Ports > Physical Ports > Other. 244

275 Table 10-3: Expert > Terminal Server (TS) Connected Protocols (Continued) Protocol Name Local Terminal Raw Socket Result Dedicates a computer terminal that is connected to the selected serial port for connecting to CS. When the attached terminal is powered on, CS opens a Telnet session on itself. The user then can use any of the CS s Linux commands. You can also create a terminal profile menu, Applications > Terminal Profile Menu that enables the user to quickly launch sessions on any number of remote hosts. Dedicates a computer terminal that is connected to the selected serial port to access a specific remote host using the Raw Socket protocol. When the attached terminal is powered on, the CS opens a Raw Socket session on the host using an IP address and TCP port number that should be specified on the Other form, Ports > Physical Ports > Other. Bidirectional Telnet Protocol Bidirectional Telnet protocol can be selected from the Ports > Physical Ports > General from. Bidirectional Telnet supports both a CAS profile Telnet connection, and a TS profile menu shell. Both connection protocols are supported on one port, however, connections cannot be opened simultaneously. Note: The Console profile features such as data buffering, multiple users, and event notifications are not available under this protocol. When the attached terminal is powered on and the keyboard s [Enter] key is pressed, a login banner and a login prompt is displayed. Note: If the user does not login within a configurable timeframe, the serial port returns to an idle state. The timeout period can be configured through the Web Manager Ports > Physical Ports > Access form. The administrator can build custom menus using the Terminal Profile Menu form accessible from Web Manager, Applications > Terminal Profile Menu, or BLACK BOX CS Installation, Administration, and User s Guide 245

276 Ports Menu & Forms from a terminal window using the menush_cfg command. You should specify the bidirectional shell command, /bin/menush in the Web Manager, Ports > Physical Ports > Access form. Modem and Power Management Connection Protocols The following table shows the connection protocols for modems or AlterPath PM IPDUs connected to the serial ports. Table 10-4: Expert > Protocols for Serial Ports Connected to Modems or IPDUs Protocol Name PPP-No Auth PPP SLIP CSLIP Power Management Result Starts a PPP session without interactive authentication required. Assumes the specified CS serial port is connected to an external modem. Starts a PPP session with authentication required. Assumes the specified CS serial port is connected to an external modem. Starts a SLIP session. Assumes the specified CS serial port is connected to an external modem. Starts a CSLIP session. Assumes the specified CS serial port is connected to an external modem. Configures the serial port for power management. Assumes an AlterPath PM IPDU is connected to the serial port. To Configure a Serial Port Connection Protocol for a Console Connection This procedure assumes that the selected serial port is physically connected to a console port on a device. 1. Go to Ports > Physical Ports in Expert mode, select a port or ports to modify, click the appropriate Modify Ports button. The General form appears. The port configuration section includes six forms in tabbed format as shown in the following figure. 246

277 Figure 10-5: Expert > Ports > Physical Ports > Console Connection Active Tabs 2. Click the General tab. The General form appears with the number(s) of the selected port(s) next to the Done button at the bottom of the form, and all the active tabs in yellow. Figure 10-6: Expert > Ports > Physical Ports > Console Connection 3. To change the connection protocol, select one of the options from the Connection Protocol pull-down menu: Console (Telnet), Console (SSH), Console (Telnet & SSH), or Console (Raw). The default is Console (Telnet). BLACK BOX CS Installation, Administration, and User s Guide 247

278 Ports Menu & Forms Figure 10-7:Connection Protocols > Console 4. If you want to change any of the other current settings, see "To Configure Serial Port Settings to Match the connected devices" on page To further configure the serial port s connection protocol: For user access and authentication methods see "Access" on page 259. To specify the TCP Port number and other port configuration options see "Other" on page 277. To Configure a Serial Port Connection Protocol for a Bidirectional Telnet This procedure assumes that the selected serial port is physically connected to a terminal. For more information on Bidirectional Telnet connection protocol see "Bidirectional Telnet Protocol" on page Go to Ports > Physical Ports in Expert mode, select a port or ports to modify, click the appropriate Modify Ports button. The General form appears. The port configuration section includes six forms in tabbed format as shown in the following figure. Figure 10-8: Expert > Ports > Physical Ports > Bidirectional Telnet Active Tabs 2. Click the General tab. 248

279 The General form appears with the number(s) of the selected port(s) next to the Done button at the bottom of the form, and the active tabs highlighted in yellow. Figure 10-9: Expert > Ports > Physical Ports > Bidirectional Telnet Connection 3. To change the connection protocol, select Bidirectional Telnet from the Connection Protocol pull-down men. Figure 10-10: Connection Protocols > Bidirectional Telnet BLACK BOX CS Installation, Administration, and User s Guide 249

280 Ports Menu & Forms 4. If you want to change any of the other current settings, see "To Configure Serial Port Settings to Match the connected devices" on page Go to Access tab and configure the following settings: In the Authorized Users/Groups field restrict or deny access to a serial port by specifying one or more users or groups. From the Type pull-down menu, select an authentication type for the serial port. The default is no authentication (Type=None). In the BidirectionLogin Timeout field enter the time for the serial port to return to idle state. When the username is not entered in the terminal window after the login banner is displayed, the serial port returns to an idle state. The default timeout value is 60 seconds. In the BidirectionShell Command field enter the menu shell command, for example, /bin/menush to build a custom menu for the TS profile. 6. To customize a menu shell, go to Web Manager > Applications > Terminal Profile Menu form. For more information on configuring a menu shell see Terminal Profile Menu on page 146. To Configure a Serial Port Connection Protocol for a Terminal Server This procedure assumes that the selected serial port is physically connected to a terminal. For more information on Terminal Server connection protocols see "Terminal Server (TS) Profile Connection Protocols" on page Go to Ports > Physical Ports in Expert mode, select a port or ports to modify, click the appropriate Modify Ports button. The General form appears. The port configuration section includes six forms in tabbed format as shown in the following figure. Figure 10-11:Expert > Ports > Physical Ports > Terminal Server Active Tabs 2. Click the General tab. 250

281 The General form appears with the number(s) of the selected port(s) next to the Done button at the bottom of the form, and the active tabs highlighted in yellow. Figure 10-12: Expert > Ports > Physical Ports > Terminal Server Connection 3. To change the connection protocol, select a Terminal Server connection from the Connection Protocol pull-down men, Telnet, SSHv1, SSHv2, Local Terminal, or Raw Socket. Figure 10-13:Connection Protocols > Terminal Server BLACK BOX CS Installation, Administration, and User s Guide 251

282 Ports Menu & Forms 4. To configure a terminal to automatically connect to CS, do the following steps. a. Select Local Terminal from the Connection Protocol pull-down menu. b. Define a terminal profile menu. Terminal Profile Menu form is at Expert > Applications > Terminal Profile Menu. 5. To configure a terminal to automatically connect to a server, do the following steps. a. Select Telnet, SSHv1, SSHv2, or Raw Socket from the Connection Protocol pull-down menu. b. Specify authorized users/groups and the authentication method in the Access form. c. Specify the TCP Port number, the IP address of the remote host, and the terminal type using the Other form. The Other form is located at Ports > Physical Ports > Modify Selected Ports > Other. 6. If you are finished, click Done. 7. Click apply changes. To Configure a Serial Port Connection Protocol for an External Modem This procedure assumes that the selected serial port is physically connected to an external modem. 1. Go to Ports > Physical Ports in Expert mode, select a port or ports to modify, click the appropriate Modify Ports button. The General form appears. The port configuration section includes six forms in tabbed format as shown in the following figure. Figure 10-14: Expert > Ports > Physical Ports > Modem Connection Active Tabs 2. Click the General tab. 252

283 The General form appears with the number(s) of the selected port(s) next to the Done button at the bottom of the form, and the active tabs highlighted in yellow. Figure 10-15: Expert > Ports > Physical Ports > Modem Connection 3. To change the connection protocol, select one of the options from the Connection Protocol pull-down menu: PPP-No Auth., PPP, SLIP, or CSLIP. Figure 10-16: Connection Protocols > Modem BLACK BOX CS Installation, Administration, and User s Guide 253

284 Ports Menu & Forms 4. If you want to change any of the other current settings, see "To Configure Serial Port Settings to Match the connected devices" on page To further configure the serial port s connection protocol: For user access and authentication methods, see "Access" on page 259. To specify the TCP Port number, and configure modem initialization and PPP options see "Other" on page If you are finished, click Done. 7. Click apply changes. To Configure a Power Management Protocol for an IPDU This procedure assumes that an IPDU is physically connected to the selected serial port. 1. Go to Ports > Physical Ports in Expert mode, select a port or ports to modify, click the appropriate Modify Ports button. The General form appears. The port configuration section includes six forms in tabbed format as shown in the following figure. Figure 10-17: Expert > Ports > Physical Ports > Power Management Active Tabs 2. Click the General tab. The General form appears with the number(s) of the selected port(s) next to the Done button at the bottom of the form. 254

285 Figure 10-18: Expert > Ports > Physical Ports > Power Management Connection 3. To change the connection protocol, select Power Management from the Connection Protocol pull-down menu. Figure 10-19: Connection Protocols > Power Management 4. Enter a desired name for the IPDU in the Alias field. BLACK BOX CS Installation, Administration, and User s Guide 255

286 Ports Menu & Forms 5. Select an access method to the IPDU from the Allow Access by dropdown menu. The options are SSH, Telnet, or SSH and Telnet. Selecting an access option activates the Access and Other tabs. 6. Go to Access tab. a. enter the users/groups that are authorized to access the serial port. b. Select an authentication type for the serial port from the pull-down menu. Figure 10-20: Access > Authentication Types Note: Authentication type None is not a valid option when the serial port is configured for Power Management connection protocol. The system defaults to Local if no authentication type is selected. 7. Go to Other tab. a. A default TCP port number is displayed in the TCP Port field. Enter an alternate port number if you are overriding the default. b. Enable Biometric Authentication Required if you are using an AlterPath Bio device. Note: Biometric Authentication Required field is available when the selected access method is SSH or SSH and Telnet. 256

287 8. If you are finished, click Done. 9. Click apply changes. To Associate an Alias to a Serial Port An alias (name) can be associated to a port when it s individually selected for modification. To associate an alias to a port perform the following steps. 1. Go to Ports > Physical Ports in Expert mode, select a port to modify, and click the Modify Ports button. 2. Enter the desired string in the Alias field. 3. Click Done. 4. Click apply changes. Note: The Alias field cannot be set if you select the Modify All Ports. To Configure Serial Port Settings to Match the connected devices The settings for a serial port must match the connection settings on the connected device. 1. Go to Ports > Physical Ports in Expert mode, and select a port or ports to modify. The General form appears. BLACK BOX CS Installation, Administration, and User s Guide 257

288 Ports Menu & Forms Figure 10-21: Expert > Ports > Physical Ports > Serial Port Settings 2. To change the baud rate, select an option from 2400 to Kbps from the Baud Rate pull-down menu. The default is 9600, which is the most common baud rate for seriallymanaged devices. 3. To change the flow control, select None, Hardware, or Software from the Flow Control pull-down menu. The default is None. 4. To change the parity, select None, Odd, or Even from the Parity pull-down menu. The default is None. 5. To change the data size, select an option from 5 to 8 from the Data pulldown menu. The default is To change the stop bits, select 1 or 2 from the stop bits pull-down menu. The default is

289 7. To change whether the DCD (Data Carrier Detect) State is disregarded or not, select either Disregard or Regard. 8. Click Done. 9. Click apply changes. Access Under Ports > Physical Ports in Expert Mode, after you select one or more serial ports, and click the Modify Port(s), select the Access form from the tabbed menu. The following form appears. Figure 10-22:Expert > Ports > Physical Ports > Access Form BLACK BOX CS Installation, Administration, and User s Guide 259

290 Ports Menu & Forms The following table describes the menu and fields on the Access form. Table 10-5: Expert > Access Form Fields Field Authorized Users/Groups Type BidirectionLogin Timeout Description Restrict or deny access to a serial port by specifying one or more users or groups. You can deny access to one or more users or groups by entering an exclamation point (!) before the user or group name. For example, to explicitly deny access to a user called noadmin and enable access only to a single user called johnd you would enter the following:!noadmin,johnd Note that the names are separated by a comma. Select an authentication type for the serial port from the pull-down list. The default is no authentication (Type=None). Note: Authentication type None is not a valid option when the serial port is configured for Power Management connection protocol. The system defaults to Local if no authentication type is selected. Configure the time for the serial port to return to idle state, if the username is not typed in the terminal after the login banner is displayed. The default timeout value is 60 seconds. This field is available only when a Bidirectional Telnet protocol is selected from Ports > Physical Ports > General > Connection Protocol. 260

291 Table 10-5: Expert > Access Form Fields Field BidirectionShell Command Description Specify the menu shell command in this field, for example, /bin/menush and build a custom menu for the TS profile using Web Manager > Applications > Terminal Profile Menu form. This field is available only when a Bidirectional Telnet protocol is selected from Ports > Physical Ports > General > Connection Protocol. To Configure User Access to Serial Ports Use this procedure if you want to specify a list of authorized users or groups. 1. Go to Ports > Physical Ports in Expert mode, and select a port or ports to modify. 2. Click the Access tab. The Access form appears. 3. To restrict access to one or more users or to a group of users, enter previously defined user or group names in the Authorized Users/Groups field, with the names separated by commas. 4. To deny access to one or more users or groups, preface the user or group names with an exclamation point (!). 5. Click Done. 6. Click apply changes. Authentication Methods and Fallback Mechanism The following table provides a brief description of the authentication methods. When an authentication method is configured to be performed by an authentication server such as Kerberos, LDAP, RADIUS, or TACACS+, the user can get access denial if either the authentication server is down, or it does not authenticate him/her. An authentication fallback mechanism can be BLACK BOX CS Installation, Administration, and User s Guide 261

292 Ports Menu & Forms defined in case the first authentication level fails. See the following table on authentication methods and fallback mechanisms. Table 10-6: Expert > Authentication Methods Authentication Type Definition None Kerberos Kerberos/Local KerberosDownLocal LDAP LDAP/Local LDAPDownLocal Local Local/Radius Local/TACACS+ Local/NIS NIS NIS/Local No authentication. Authentication is performed using a Kerberos server. Kerberos authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the Kerberos server is down. Authentication is performed against an LDAP database using an LDAP server. LDAP authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the LDAP server is down. Authentication is performed locally. For example, using the /etc/passwd file. Authentication is performed locally first, switching to Radius if unsuccessful. Authentication is performed locally first, switching to TACACS+ if unsuccessful. Authentication is performed locally first, switching to NIS if unsuccessful. NIS authentication is performed. NIS authentication is tried first, switching to Local if unsuccessful. 262

293 Authentication Type NISDownLocal Radius Radius/Local RadiusDownLocal TACACS+ TACACS+/Local TACACS+DownLocal Definition Local authentication is performed only when the NIS server is down. Authentication is performed using a Radius authentication server. Radius authentication is tried first, switching to Local if unsuccessful. Local authentication is performed only when the Radius server is down. Authentication is performed using a TACACS+ authentication server. TACACS+ authentication is tried first, switching to Local if unsuccessful. Local authentication is tried only when the TACACS+ server is down. To Configure a Serial Port Login Authentication Method This procedure configures an authentication method that applies to logins to devices connected to serial ports. You can select different methods for individual ports or for groups of ports. 1. Go to Ports > Physical Ports in Expert mode, and select a port or ports to modify. 2. Click the Access tab. 3. To select an authentication method, select one of the options in the Type menu. 4. Click Done. 5. Click apply changes. The changes are stored in /etc/portslave/pslave.conf on CS. 6. Make sure that an authentication server is specified for the selected authentication type. BLACK BOX CS Installation, Administration, and User s Guide 263

294 Ports Menu & Forms The following table lists the procedures that apply to each authentication method. Table 10-7: Expert > Procedures to Configure an Authentication Server Authentication Method Kerberos, Kerberos/Local, or Kerberos/ DownLocal LDAP, LDAP/Local, or LDAP/DownLocal NIS, Local/NIS, NIS/Local, or NIS/ DownLocal RADIUS, Local/RADIUS, RADIUS/Local, or RADIUS/DownLocal TACACSPlus, Local/TACACSPlus, TACACSPlus/Local, or TACACSPlusDownLocal Where Documented "To Configure a Kerberos Authentication Server" on page 223. "To Configure an LDAP Authentication Server" on page 221. "To Configure a NIS Authentication Server" on page 225. "To Configure a RADIUS Authentication Server" on page 218. "To Configure a TACACS+ Authentication Server" on page 219. Data Buffering Under Ports > Physical Ports in Expert Mode, after you select one or more serial ports, and click the Modify Port(s), you can select the Data Buffering form from the tabbed menu. The following form appears. Figure 10-23:Expert > Ports > Physical Ports > Data Buffering 264

295 There are different fields on this form depending on whether one or both options are enabled. The form displays Enable Data Buffering and Buffer to Syslog options. If Enable Data Buffering is active, the form displays different fields depending on whether Local or Remote are selected from the Destination menu. If Buffer to Syslog is checked, data buffer files are sent to the syslog server. Note: Go to Wizard > Step 5:System Log, or Expert > Network > Syslog to set up a syslog server. The following form shows both checkboxes ( Enable Data Buffering and Buffer to Syslog ) and the Local destination selected. Figure 10-24: Expert > Ports > Physical Ports > Data Buffering The following table describes the fields available in the data buffering form. Table 10-8: Expert > Data Buffering Form Fields Field Name Destination Definition Location for the data files. Either Local or Remote BLACK BOX CS Installation, Administration, and User s Guide 265

296 Ports Menu & Forms Table 10-8: Expert > Data Buffering Form Fields Field Name Mode (Local Destination) File Size (Bytes) (Local Destination) NFS File Path (Remote Destination) Record the timestamp... Show Menu Syslog Server Facility Number Syslog Buffer Size Buffer SysLog at all times Buffer SysLog only when nobody is connected to the port Definition circular or linear. In circular mode, data is written into the specified local data file until the upper limit on the file size is reached; then the data is overwritten starting from the top of the file as additional data comes in. Circular buffering requires the administrator to set up processes to examine the data during the timeframe before the data is overwritten by new data. The maximum file size for the data buffer file. The file size must be greater than zero. The path for the mount point of the directory where data buffer file is to be stored. Note: The NFS server must already be configured with the mount point shared (exported), and the shared directory from the NFS server must be mounted on the CS. Save a timestamp with the data in the data buffer file. Options for the buffer file. The IP address for the preconfigured Syslog server. Choose a facility number to assign to CS. Obtain the facility number for CS from the system administrator of the syslog server. The facility number is included in any syslog message generated from CS. The server s administrator can use facility numbers to isolate logs from individual devices into individual files. Options range from Local0 to Local7. Maximum size of the buffer in the Syslog server. As indicated. As indicated. 266

297 To Configure Data Buffering for Serial Ports Perform this procedure if you want to configure data buffering. Obtain the facility number for the CS from the system administrator of the syslog server. Options range from Local0 to Local7. 1. Go to Ports > Physical Ports in Expert mode, and select a port or ports to modify. 2. Select the Data Buffering tab. The Data Buffering form displays. 3. Select Enable Data Buffering and perform the following steps. a. From the Destination pull-down menu, choose Local or Remote to specify whether the data buffer files are stored locally or remotely on a file server. b. If you chose Local from the Destination pull-down menu, do the following: i. Choose Circular or Linear from the Mode pull-down menu. ii. Enter a size larger than 0 in the File Size (Bytes) field. c. If you chose Remote from the Destination pull-down menu, enter the NFS mount point for the directory where data buffer file is to be stored in the NFS File Path field. Note: If you are configuring data buffer files to be stored remotely, make sure that a system administrator has already configured an NFS server and shared the mount point. d. Click the checkbox next to Record the timestamp in the data buffering file to specify whether to include a timestamp with the data. e. From the Show Menu pull-down menu, choose among the following options: Show all options No BLACK BOX CS Installation, Administration, and User s Guide 267

298 Ports Menu & Forms Show data buffering file only Show without the erase options 4. If you checked Buffer to Syslog, perform the following steps. a. Enter the IP address of the syslog server in the Syslog Server field. b. Choose an option from the Facility Number pull-down menu. Note: Obtain the facility number from the system administrator of the syslog server. Options range from Local0 to Local7. c. Enter the maximum size of the buffer in the Syslog Buffer Size field. d. Click the radio button next to one of the following options: Buffer Syslog at all times Buffer only when nobody is connected to the port 5. Click Done. 6. Click apply changes. To configure alarm notifications to be sent based on the type of buffered data, use the Notifications form, Expert > Administration > Notifications. Multi User Under Ports > Physical Ports in Expert Mode, after you select one or more serial ports, and click the Modify Port(s), you can select the Multi User form from the tabbed menu. The following form appears. 268

299 Figure 10-25:Expert > Port > Physical Ports >Multi User The Multi User form enables you to open more than one session from the same serial port. Multiple users can connect simultaneously to a serial port. To connect to a port or start a shared session, the user must have permission to access the port. If you allow multiple sessions through Allow Multiple Sessions drop-down menu, the Privilege Users field should be populated with the usernames who have access rights. The following table describes the available fields on the Multi User Form. Table 10-9: Expert > Multi User Form Fields Field Name Definition Allow Multiple Sessions Sniff Mode Privilege Users Menu Hotkey Options are No, Yes (show menu), Read/Write (do not show menu), and ReadOnly (do not show menu). See Table 10-9 for more detail. Allow sniffing on multiple user connection to a serial port. Users with access rights to a multi user shared session. The hotkey for accessing the menu. BLACK BOX CS Installation, Administration, and User s Guide 269

300 Ports Menu & Forms Field Name Notify Users Definition Checkbox to enable notify users of session access. The following table describes the options from the Allow Multiple Sessions pull-down menu. Table 10-10: Expert > Options on the Allow Multiple Sessions Menu Menu Option No Yes (show menu) Read/Write (do not show menu) ReadOnly (do not show menu) Description Do not allow multiple sessions. Only two users can connect to the same port simultaneously. One shared session and one normal session are allowed. More than two simultaneous users can connect to the same serial port. A Sniffer menu is presented to the user and they can choose to: Open a sniff session Open a read/write session Cancel a connection Send a message to other users connected to the same serial port. Read/write sessions are opened, and the sniffer menu won t be presented. Read only sessions are opened, and the sniffer menu won t be presented. To Configure Multiple Sessions and Port Sniffing for One or More Serial Ports 1. Go to Ports > Physical Ports in Expert mode, and select a port or ports to modify. 2. Click the Multi User tab. 270

301 3. To allow or to prevent multiple sessions, select an option from the Allow Multiple Sessions pull-down menu. The options are: No, Yes (show menu), Read/Write (do not show menu), ReadOnly. 4. To configure the type of data that displays on the monitor in a port-sharing session, select an option from the Sniff Mode pull-down menu. 5. If you have allowed multiple sessions, complete the following fields. a. Add usernames to the Privilege Users field. b. Enter a hot key in the Menu Hotkey field to display the sniffer menu on the monitor. The default shown is [^z]. The caret stands for the Ctrl key. c. Enable the Notify Users field, if desired. 6. Click Done. 7. Click apply changes. Power Management Under Ports > Physical Ports in Expert Mode, after you select one or more serial ports, and click the Modify Port(s), you can select the Power Management form from the tabbed menu. The following form appears. Figure 10-26:Expert > Ports > Physical Ports > Power Management BLACK BOX CS Installation, Administration, and User s Guide 271

302 Ports Menu & Forms You can use this form to make it possible for a user who is connected to a device through the selected serial port to perform power management. While connected to the device, the user brings up a power management menu or dialog box by entering a hot key. Note: Enable power management on this form refers to IPDU power management, Applications > IPDU Power Mgmt. Additional fields appear on the form if Enable Power management on this port and Enable IPMI on this port are checked, as shown in the following figure. Figure 10-27: Expert > Ports > Physical Ports > Power Management The following table describes the available fields in the power management form. Table 10-11: Expert > Power Management Form Fields Field Name Definition Enable Power Management on this Port Check mark to enable Power Management on the the selected port(s). 272

303 Field Name Enable IPMI on this port IPMI Key (available only if IPMI is enabled) IPMI Server (available only if IPMI is enabled) PowerMgmt Port Power Management Key Allow All Users Allow Users/Groups New User/Group (available only if Allow Users/ Groups radio button is selected) Allowed Users/Groups (available only if Allow Users/ Groups radio button is selected) Definition Check mark to enable IPMI on the selected port(s). The key sequence which the authorized user(s) can use to perform IPMI power management. The default for IPMI power management is Ctrl+Shift+i (^I) Select the device configured for IPMI power management. View listbox for the PM enabled ports and the assigned outlet numbers. The key sequence which the authorized user(s) can use to perform power management. The default for IPDU power management is Ctrl+p (^p) Radio button to allow all users to perform power management on the configured port. Radio button to allow only selected users or groups to perform power management on the configured port. Entry field to add a new user/group View list box of authorized users or groups. BLACK BOX CS Installation, Administration, and User s Guide 273

304 Ports Menu & Forms Power management while connected to a port is possible only when one or both of the following conditions are true. The device connected to CS is plugged into an AlterPath PM IPDU and is configured for power management. The device connected to CS is a server with an IPMI controller and the server is added to the IPMI device list. To see the list of previously configured IPMI devices, or to add a new IPMI device, go to Applications > IPMI Power Mgmt. If you click Enable power management and click the Add button, the Add Outlet dialog box appears, as shown in the following figure. In this dialog box, you can specify the AlterPath PM IPDU and the outlet number(s) into which the device is plugged. Figure 10-28: Expert > Ports > Physical Ports > Power Management > Add Outlets Dialog Box The PM on the Power Management Alias pull-down menu in the example figure indicates that a serial port is configured for power management, and an IPDU is connected to the configured port. Entered outlet numbers are separated by commas. You would specify outlet number 1,2,3,4 as shown in the figure. To Configure a Serial Port for IPDU or IPMI Power Management 1. Go to Ports > Physical Ports, select a port or ports to modify, click the appropriate Modify Ports button, and the Power Management tab. 274

305 2. To enable Power Management of a device connected to the current port and plugged into a connected IPDU, click Enable Power Management on this port. and perform the following steps. a. Select the name of a port configured for power management and click the Add button. The Add Outlet dialog box appears. b. Enter the outlet number(s) into which the device is connected to separated by commas. c. Click OK. The power management port and the specified outlet numbers display on the PowerMgmt Port list. d. Enter the power management hot key in the Power Management Key field. Enter a caret (^) for the escape key, as in ^p. The caret stands for the Ctrl key. If you want to configure IPMI power management on this port, continue to Step 3. If you are done, go to Step To enable IPMI Power Management of an IPMI device connected to the currently selected port, do the following steps. This procedure assumes you have added the connected IPMI device in the Applications > IPMI Power Mgmt. form. a. Click the Enable IPMI on this port checkbox The IPMI key and IPMI Server fields appear. b. Enter a key in the IPMI key field. Enter the key combination in the IPMI key field with ^, as in ^i. The caret (^) stands for the Ctrl key. The administrator of the device connected to this serial port uses this hot key to bring up the IPMI power management screen. c. Select the name of the IPMI device from the IPMI Server pulldown menu. BLACK BOX CS Installation, Administration, and User s Guide 275

306 Ports Menu & Forms 4. Click Done. 5. Click apply changes. To Configure a User for IPDU Power Management While Connected To a Serial Port Perform this procedure to allow a user to perform power management on a device while connected to it through one of the CS s serial ports. 1. Configure a serial port for IPDU power management as described in the previous section. 2. To permit everyone to perform power management on this port, click the Allow All Users radio button. Figure 10-29: Expert > Ports > Physical Ports > Power Management>Allow All Users 3. To restrict power management on this port to a set of users authorized to access this port, click the Allow Users/Groups. Figure 10-30: Expert > Ports > Physical Ports >Power Management >Allow Users/ Groups 276

307 4. Enter a valid username or groupname in the New User/Group field, and click Add. 5. Click Done. 6. Click apply changes. Other Under Ports > Physical Ports in Expert Mode, after you select one or more serial ports, and click the Modify Port(s), you can select the Other form from the tabbed menu to configure other options. The following form appears. Figure 10-31:Expert > Ports > Physical Ports > Other Form You can use this form to configure other settings. The options on this form may be less common settings. The following table describes the available fields in the Other form. BLACK BOX CS Installation, Administration, and User s Guide 277

308 Ports Menu & Forms Table 10-12: Expert > Ports > Physical Ports > Other Form Fields Field Name Definition TCP Port Port IP Alias Windows EMS Biometric Authentication Required TCP Keep-alive Interval Idle Timeout The TCP Port number for a serial port. The TCP port numbers by default start from 7001 and increment by +1 up to the number of serial ports that the CS unit has. For example, an CS unit with 8 serial ports have TCP port numbers 7001 through A name (alias) for the IP of the selected port. A port IP alias field appear when a console (CAS) profile is selected from the Connection Protocol pull-down menu on the General form. Checkbox to enable Windows EMS (Emergency Management Services). Appears only when a console (CAS) profile is selected from the Connection Protocol drop-down menu on the General form. Adds another layer of security by using the AlterPath Bio authentication scanner. This option is available when a Console (SSH), or a Console (TelnetSSH) profile is selected from the Connection Protocol pull-down menu on the General form. Specifies the time interval between the periodic polling by the system to check client processes and connectivity. The maximum time (in seconds) that a session can be idle before the user is logged off. 278

309 Field Name STTY Options Break Interval Break Sequence Login Banner Host to Connect Terminal Type Definition Set terminal options. Usually 250 to 500 milliseconds. It s a logical zero on the TXD or RXD lines to reset the communications line. Usually a character sequence ~break (Ctrl-b) Enter the text you wish to appear as a login banner when logging into a terminal. This field should be populated with the IP address of the device you are connecting to. The field is displayed when a terminal server (TS) profile is selected from the Connection Protocol drop-down menu on the General form. This field should be populated with the terminal type when connecting to a host system. The field is displayed when a terminal server (TS) profile is selected from the Connection Protocol drop-down menu on the General form. To Configure TCP Port Number, STTY Options, Break Interval, and the Login Banner for a Serial Port Connected to a Console 1. Go to Ports > Physical Ports in Expert mode, and select a port or ports to modify. 2. Select the Other tab. BLACK BOX CS Installation, Administration, and User s Guide 279

310 Ports Menu & Forms 3. To change the port number for the serial port, enter another number in the TCP Port field. 4. To assign a name to the port s IP address, enter an alias in the Port IP Alias field. (Console connection protocol only) 5. If connecting to a Microsoft Windows Server 2003 operating system through the Emergency Management Services (EMS) console, enable the Windows EMS. (Console connection protocol only) 6. If using AlterPath Bio for an additional layer of security, enable Biometric Authentication Required field. (Console SSH connection protocol only) 7. To change the keep-alive interval, enter another number in the TCP Keep-alive Interval field. 8. To change the idle timeout interval, enter another value in the Idle Timeout field. 9. Specify stty options, if desired, in the STTY Options field. 10. To change the break interval, enter a new number in the Break Interval field. 11. To change the break sequence, enter a new sequence in the Break Sequence field. 12. To change the content of the login banner, enter new content in the Login Banner field. 13. Click Done. 14. Click apply changes. To Configure Terminal Server Connection Options Do this procedure if you have connected a computer terminal to a serial port. 1. Select the port and choose a terminal server (TS) profile from the Connection Protocol drop-down menu on General form. 2. Select the Other tab. The Other form appears. 280

311 3. To change the port number used to access the serial port, enter another number in the TCP Port field. 4. To change the keep-alive interval, enter another number in the TCP Keep-alive Interval field. 5. To change the idle timeout interval, enter another value in the Idle Timeout field. 6. Specify stty options, if desired, in the STTY Options field. 7. To change the break interval, enter a new number in the Break Interval field. 8. To change the break sequence, enter a new sequence in the Break Sequence field. 9. To change the content of the login banner, enter new text in the Login Banner field. 10. For a dedicated terminal, enter the IP address of the desired host in the Host to Connect field. 11. Enter the type of terminal in the Terminal Type field. 12. Click Done. 13. Click apply changes. Virtual Ports When Virtual Ports is selected under Ports > Virtual Ports in Expert mode, the following form appears. BLACK BOX CS Installation, Administration, and User s Guide 281

312 Ports Menu & Forms Figure 10-32: Expert > Ports > Virtual Ports The virtual ports form allows you to perform clustering of CS units. The CS clustering is designed to allow a large number of serial ports (up to 1024) to be configured and virtually accessed through one IP address. Note: Clustering only works for ports that are configured as CAS profile. You can use one CS as the master unit to control other CS units as slaves. The ports on the slave unit(s) appears as if they are part of the master unit. Note: Multiple IPDUs should only be connected and daisy-chained through the serial port of the master CS unit when you are configuring a cluster. This section shows you how to define and configure the slaves. When you click the Add or Edit button on the Ports > Virtual Ports form, the following dialog box appears. 282

313 Figure 10-33: Expert > Ports > Virtual Ports > New/Modify Port Dialog Box The following table describes the fields available in the Virtual Ports New/ Modify Port dialog box. Table 10-13: Expert > New/Modify Port Dialog Box Fields Field Name Definition Number of Ports First Local Port Number Local IP Number of ports on each slave unit. Choices are 1, 4, 8, 16, 32 and 48. The first unallocated port number for the slave. For example, if the master unit has 16 ports, ports 1-16 are allocated. The First Local Port Number is then 17. The IP address for the master CS or it can be the global IP address of the cluster in the network. BLACK BOX CS Installation, Administration, and User s Guide 283

314 Ports Menu & Forms Field Name First Local TCP Port No. Remote IP First Remote TCP Port Number Protocol Definition The first TCP port number for the slave. For example, if the master unit has 16 ports, the allocated TCP port numbers to the master are The First Local TCP Port No. is then This is a virtual TCP port number. The IP address of the slave. The first TCP port number of the slave. The default is The communication protocol used by the slave. The options are Telnet or SSH. Once you have configured the Slave CS unit and defined the cluster parameters, the slave serial ports and the connected devices are accessible from the master CS unit under Applications > Connect > Serial pull-down menu as shown in the following figure. 284

315 Figure 10-34: Expert > Applications > Connect > Serial pull-down menu To Cluster CS Units or Modify Cluster Configuration Use this procedure if you want to cluster CS units and add or modify ports. Note: CS boxes should be connected individually to an IP network. The units should not be cascaded. 1. Go to Ports > Virtual Ports in Expert mode, and click the Add button to add new slave ports, or click the Edit button to edit a slave port. The New/Modify Port dialog box appears. Figure 10-35: Expert > Ports > Virtual Ports > New/Modify Port Dialog Box 2. From the drop-down menu select the number of ports that you want to assign as slaves. Choices are 1, 4, 8, 16, 32 and Enter the First Local Port Number. BLACK BOX CS Installation, Administration, and User s Guide 285

316 Ports Menu & Forms This is the first port number on the master, after the last port number on the master. 4. Enter the Local IP address. This is the IP address of the master. 5. Enter the First Local TCP Port Number. This is the first TCP port number on the master, after the last port number on the master. 6. Enter the Remote IP address. This is the IP address of the slave. 7. Enter the First Remote TCP Port Number. This is the first TCP port number of the slave. The default is Select the communication protocol between the master and the slave from the Protocol pull-down menu. The options are Telnet or SSH. To Assign Names to Slave ports in the Cluster Pressing the Port Names button on the New/Modify Port dialog box, brings up the form shown in the following figure. 286

317 Figure 10-36: Expert > Ports > Virtual Ports > New/Modify > Port Names Dialog box Use this form to assign a name or alias to the slave ports in the cluster. Use a naming convention for effective management of the CS units and the connected devices on your network. Ports Status Selecting Ports > Port Status in Expert mode, brings up the following readonly form, which displays tabular serial port status information. BLACK BOX CS Installation, Administration, and User s Guide 287

318 Ports Menu & Forms Figure 10-37: Expert > Ports > Ports Status (Read-Only) The information in the following table is available in the Ports Status readonly form. All users have access to this form. The information on this page gets updated when you click the Refresh button. Table 10-14: Expert > Port Status Read-Only Form Column Name Description Port Alias RS232 Signal Status Current User(s) The serial port number. Displays the name (alias) for the serial port if one is assigned by the administrator. Serial Communication Signal Status Displays the user(s) connected to each serial port. Ports Statistics Selecting Ports > Port Statistics in Expert mode, brings up the following readonly form. 288

319 Figure 10-38: Expert > Ports > Port Statistics (Read-Only) The following information is available in the Ports Statistics read-only form. All users have access to this form. The information on this page gets updated when you click the Refresh button. Table 10-15: Expert > Ports>Port Status Read-Only Form Column Name Description Port Alias Baud Rate Tx Bytes Rx Bytes Frame The serial port number. Displays the name (alias) for the serial port if one is assigned by the administrator. The measure of how fast data is moving between devices. Data transmitted. Data received. A formatted packet of data usually associated with the Data-Link layer. BLACK BOX CS Installation, Administration, and User s Guide 289

320 Ports Menu & Forms Column Name Parity Break Overrun Description Error checking bit appended to a data packet. A method of checking the accuracy of transmitted characters. Parity is usually not used, but can be odd or even. A None parity means that data has not exchanged. An out-of-band signal on an RS-232 serial port that involves making the Tx data line active for more than two whole character times (or about 2ms on a 9600bps line). The amount of time it takes for the new data to overwrite the older unread data. 290

321 Chapter 11 Administration Menu & Forms This Chapter describes the Administration menu and the related forms. The following table provides a description of the left menu panel links to the detailed information and procedures. Table 11-1: Expert > Administration Menu Menu Selection Use this menu to: Where Documented System Information Notifications Time/Date View information on the system hardware, version, file system and PCMCIA cards loaded. Configure the alarm strings and the destination of the notification. CS can send notification by , pager or SNMP trap in the occurrence of any system warnings and alarms. Set the timezone and configure the system s date and time manually, or use Network Time Protocol (NTP). Page 292 Page 295 Page 305

322 Administration Menu & Forms Menu Selection Use this menu to: Where Documented Boot Configuration Backup Config Upgrade Firmware Configure CS to boot from its internal firmware or from the network. This section defines the settings for loading the operating system in the event that the CS fails to boot successfully. CS can boot from its internal firmware or from the network. Configure an FTP server to save and retrieve your CS configuration, or choose a storage device to store your configuration. Upload or upgrade to a new firmware. Page 307 Page 310 Page 313 Reboot Reboot the CS. Page 316 Online Help Configure a path to a local server for storing the online help files. Page 317 System Information Selecting Administration > System information in Expert mode brings up the following information form. 292

323 Figure 11-1: Expert > Administration > System Information You can use the form to view the information shown in the following table. BLACK BOX CS Installation, Administration, and User s Guide 293

324 Administration Menu & Forms Table 11-2: System Information Information Parameters System CPU Memory Kernel Version Current Date Up Time Power Supply State CPU Type Clock Speed Revision Bogomips MemTotal MemFree Buffers Cached SwapCached Active Inactive HighTotal HighFree LowTotal LowFree SwapTotal SwapFree Dirty Writeback Mapped Slab CommitLimit Committed_AS PageTables VmallocTotal VmallocUsed VmallocChunk 294

325 Table 11-2: System Information Information Parameters PCMCIA Socket 0 and Socket 1 Identification, Configuration, and Status RAMDisk Usage Filesystem 1k-blocks Used Available Use% Mounted To View System Information 1. Go to Administration > System Information in Expert mode. The System Information form appears. 2. To view all the information scroll down the form. Notifications Selecting Administration > Notifications in Expert mode brings up the following form. BLACK BOX CS Installation, Administration, and User s Guide 295

326 Administration Menu & Forms Figure 11-2: Expert > Administration > Notifications You can use this form to set up alarm notifications about system issues, problems, or other events of interest that occur on the devices that are connected to the serial ports. You can configure notifications to be sent to users through , pager or SNMP traps. The following table describes the available fields in the Notifications form. Table 11-3: Expert > Notifications Form Fields Field Name Definition Notification Alarm for Data Buffering [unlabeled view table] [unlabeled dropdown list] Enable by placing a checkmark in this field. List of alarm types and triggers. , Pager, or SNMP Notification methods. 296

327 Clicking the Add button or selecting a previously specified event and clicking the Edit button brings up the Notifications Entry dialog box. The form allows you to define alarm trigger actions and specify how to handle them. Different fields appear on the dialog boxes depending on whether , Pager, or SNMP trap notification have been selected from the Notifications form. To Choose a Method for Sending Notifications for Serial Port Data Buffering Events 1. Go to Administration > Notifications in Expert mode. The Notifications form appears. 2. Enable Notification Alarm for Data Buffering by clicking the checkbox. 3. Select , Pager, or SNMP trap from the pull-down menu. 4. To create a new entry for an event to trigger an alarm or notification, click the Add button. 5. To edit a previously-configured trigger, click the Edit button. 6. Depending on your notification method selection, go to one of the following sections. Notifications Entry Pager Notifications Entry SNMP Trap Notifications Entry Serial Ports Alarm Notification Notifications Entry When you go to Administration > Notifications, select from the pulldown menu, and click on Add or Edit button the following dialog box appears. BLACK BOX CS Installation, Administration, and User s Guide 297

328 Administration Menu & Forms Figure 11-3: Expert > Administration > Notifications > > Add/Edit Dialog box The following table describes the available fields in the notification entry dialog box. Table 11-4: Expert > Notifications Dialog Box Fields Field Name Definition Alarm Trigger The trigger expression used to generate an alarm. 298

329 Field Name [untitled dropdown field] To/From/Subject/ Body SMTP Server IP SMTP Port Definition The first time you specify an alarm trigger the pull-down menu is empty. A new trigger gets listed in the menu after it is created. The for the designated recipient of the alarm notification. The IP address of the SMTP server. The port used by the SMTP server. To Configure a Trigger for Notification for Serial Ports 1. Go to Administration > Notifications in Expert mode, and select from the pull-down menu. If desired, enable Notification Alarm for Data Buffering for an alarm to sound when the trigger action occurs; and click either Add or Edit. The Notifications Entry dialog box appears. 2. Specify the event you want to trigger a notification in the Alarm Trigger field. 3. If you need to edit an existing notification select it from the drop-down list and proceed. 4. Enter or change the recipient for the notification in the To field. 5. Enter or change the sender address in the From field. 6. Enter or change the subject in the Subject field. 7. Enter or edit the text message in the Body field. 8. Enter or change the SMTP server s IP address in the SMTP Server field. 9. Enter or change the SMTP port number in the SMTP Port field. 10. Click OK. 11. Click apply changes. BLACK BOX CS Installation, Administration, and User s Guide 299

330 Administration Menu & Forms Pager Notifications Entry When you go to Administration > Notifications, select Pager from the pulldown menu, and click on Add or Edit button the following dialog box appears. Figure 11-4: Expert > Administration > Notifications > Pager > Add/Edit Dialog box 300

331 The following table describes the available fields in the pager notification entry dialog box. Table 11-5: Expert > Pager Notifications Dialog Box Field Name Alarm Trigger [untitled dropdown field] Pager Number Text SMS User Name SMS Server SMS Port Definition The trigger expression used to generate an alarm. The first time you specify an alarm trigger the pull-down menu is empty. A new trigger gets listed in the menu after it is created. The pager number of the notification recipient. The text message for the pager. The user name of the notification recipient. The name or the IP address of the SMS server. The port used by the SMS server. To Configure a Trigger for Pager Notification for Serial Ports 1. Go to Administration > Notifications in Expert mode, and select Pager from the pull-down menu. If desired, enable Notification Alarm for Data Buffering for an alarm to sound when the trigger action occurs; and click either Add or Edit. The Notifications Entry dialog box appears. 2. Specify the event you want to trigger a notification in the Alarm Trigger field. 3. If you need to edit an existing notification select it from the drop-down list and proceed. 4. Enter or change the pager number in the Pager Number field. 5. Enter or edit the text that describes the event in the Text field. BLACK BOX CS Installation, Administration, and User s Guide 301

332 Administration Menu & Forms 6. Enter or change the Short Message Services (SMS) username, the SMS server s IP address or name, and the SMS port number in the SMS User Name, SMS Server, and SMS Port fields respectively. 7. Click OK. 8. Click apply changes. SNMP Trap Notifications Entry When you go to Administration > Notifications, select SNMP Trap from the pull-down menu, and click on Add or Edit button the following dialog box appears. 302

333 Figure 11-5: Expert > Administration > Notifications > SNMP Trap > Add/ Edit Dialog box SNMP traps are event notifications that are sent to a list of responsible parties that are set up to receive alerts for the managed systems. Any SNMP enabled device generates Fault Reports (Traps) that are defined in the Management Information Base (MIB). The trap definition varies with the SNMPv1 and SNMPv2, which defines the messaging format. The following table describes the available fields in the SNMP trap notification entry dialog box. Table 11-6: Expert > SNMP Trap Notifications Dialog Box Field Name Alarm Trigger [untitled dropdown field] OID Type Value Trap Number Community Server Body Definition The trigger expression used to generate an SNMP trap. The first time you specify an alarm trigger the pull-down menu is empty. A new trigger gets listed in the menu after it is created. The value that uniquely identifies an object to the SNMP agent. The trap type defined in the Management Information Base (MIB). The choices are: Cold Start Warm Start Link Down Link Up Authentication Failure EGP Neighbor Loss Enterprise Specific The password used to authenticate the traps. The IP address of the server running the SNMP. The content of the notification. BLACK BOX CS Installation, Administration, and User s Guide 303

334 Administration Menu & Forms To Configure a Trigger for SNMP Trap Notification for Serial Ports 1. Go to Administration > Notifications in Expert mode, select SNMP Trap from the pull-down menu. If desired, enable Notification Alarm for Data Buffering for an alarm to sound when the trigger action occurs; and click either Add or Edit. The Notifications Entry dialog box appears 2. Specify the event you want to trigger a notification in the Alarm Trigger field. 3. If you need to edit an existing notification select it from the drop-down list and proceed. 4. Enter or change the number in the OID Type Value field. 5. Accept the trap number or select a new one from the Trap Number pulldown menu. 6. Enter a community in the Community field. 7. Enter the IP address of the SMTP Server. 8. Enter a message in the Body text area. 9. Click OK. 10. Click apply changes. Serial Ports Alarm Notification You can configure the notification entry form to monitor the DCD signal, such that the system will generate an alarm in any of the following events. A serial console cable is removed from the console server A device/server attached to the console is powered down. The configuration also enables you to detect, if a modem that is in use, is still powered on and active. To Configure a Trigger for Serial Port Alarm Notification 1. Go to Administration > Notifications in Expert mode. 2. Enable the checkbox for Notification Alarm for Data Buffering. 304

335 3. Select , Pager, or SNMP Trap from the pull-down menu. 4. Click the Add button. 5. Enter Port in the Alarm Trigger field. 6. Configure the parameters selected in step 3, , Pager, or SNMP Trap. See Notifications on page Click OK. 8. Click apply Changes. Time/Date Selecting Administration > Time/Date in Expert mode brings up the form shown in the following figure. Figure 11-6: Expert > Administration > Time/Date You can use the Time/Date form in Expert mode to set the CS s time and date in one of the following two methods. Manual configuration by entering the time and date in the form Set up using the NTP server Enabling Network Time Protocol (NTP) synchronizes the CS s system clock with an NTP server, which maintains the true time (the average of many high-accuracy clocks around the world). If you enable the Network Time Protocol, the following form appears. BLACK BOX CS Installation, Administration, and User s Guide 305

336 Administration Menu & Forms Figure 11-7: Expert > Administration > Time/Date > NTP Enable Setting Time and Date with NTP NTP (Network Time Protocol) is an Internet standard protocol which enables your system clock to be synchronized with the true time, defined as the average of many high-accuracy clocks around the world. NTP is disabled by default. To Manually Set the Time and Date 1. Go to Administration > Time/Date in Expert mode. The Time/Date form appears. 2. Select a timezone from the Timezone pull-down list. 3. Select Disable from the Network Time Protocol menu. 4. Type the date and time in the fields provided. 5. Click apply changes. To Configure Time and Date Using an NTP Server 1. Go to Administration > Time/Date in Expert mode. The Time/Date form appears. 2. Select a timezone from the Timezone pull-down list. 3. Select Enable from the Network Time Protocol pull-down menu. The NTP Server field appears. 306

337 4. Type the IP address of the NTP server in the NTP Server field. 5. Click OK. 6. Click apply changes. Boot Configuration Selecting Administration > Boot Configuration in Expert mode brings up the form shown in the following figure. Figure 11-8: Expert > Administration > Boot Configuration Boot configuration defines the location from where CS loads the operating system. The CS can boot from its internal firmware or from the network. By default, CS boots from flash memory. If you need to boot from the network, you need to make sure the following prerequisites are met. A TFTP or BOOTP server must be available on the network. An upgraded CS boot image file must be available on the TFTP or BOOTP server. CS must be configured with a fixed IP address. The boot filename and the IP address of the TFTP or BOOTP server is known. BLACK BOX CS Installation, Administration, and User s Guide 307

338 Administration Menu & Forms The following table describes the boot configuration form fields. Table 11-7: Expert > Boot Configuration Form Fields Field Name IP Address assigned to Ethernet Watchdog Timer Unit boot from Boot Type Boot File Name Server s IP Address Console Speed Flash Test RAM Test Fast Ethernet Definition A fixed IP address or a DHCP assigned IP address to the CS unit. Whether the watchdog timer is active or Inactive. If the watchdog timer is active, the CS reboots if the software crashes. Specify whether to boot CS from flash or from the network. Select to boot from a TFTP server, a BOOTP server, or both. Filename of the boot program. The IP address of the TFTP or the BOOTP server. An alternative console speed from 4800 to (9600 is the default). Select to test boot from the Flash card. You can Skip this test or do a Full test. Select to test boot from RAM. You can Skip this test, do a Quick test, or a Full test. The speed of the Ethernet connection. Select the appropriate Ethernet setting if you need to change the Auto Negotiation (default value) 100BaseT Half-Duplex 100BaseT Full-Duplex 10BaseT Half-Duplex 10BaseT Full-Duplex 308

339 Table 11-7: Expert > Boot Configuration Form Fields Field Name Fast Ethernet Max. Interrupt Events Definition The maximum number of packets that the CPU handles before an interrupt (0 is the default). To Configure CS Boot 1. Go to Administration > Boot Configuration in Expert mode. The Boot Configuration form appears. 2. Enter the IP address of the CS in the IP Address assigned to Ethernet field. 3. Accept or change the selected option in the Watchdog Timer field. 4. Select to boot from Flash or Network from the Unit boot from menu. 5. Select TFTP, BOOTP, or Both from the Boot Type menu if you have selected Network from the Unit boot from in step Accept or change the filename of the boot program in the Boot File Name field. 7. If specifying network boot, do the following steps. a. Enter the IP address of the TFTP, or BOOTP server in the Server s IP Address field. b. Select a console speed from the Console Speed pull-down menu to match the speed of the terminal you are using on the console port of the CS. c. Select Skip or Full from the Flash Test pull-down menu to bypass or run a test on the flash memory at boot time. d. Select Skip, Quick, or Full from the RAM Test pull-down menu to bypass or run a test on the RAM at boot time. e. Choose an Ethernet speed from the Fast Ethernet pull-down menu. f. Specify the maximum number of packets that the CPU handles before an interrupt in the Fast Ethernet Max. Interrupt Events field. BLACK BOX CS Installation, Administration, and User s Guide 309

340 Administration Menu & Forms 8. Click apply changes. Backup Configuration Selecting Administration > Backup Config in Expert mode brings up the form shown in the following figure. Figure 11-9: Expert > Administration > Backup Config The Type pull-down menu options on this form are FTP and Storage Device. The storage device can be either a compact flash or an IDE PCMCIA drive. Use an FTP server to save and retrieve your CS configuration. For the backup configuration to work, the FTP server must be on the same subnet. Ensure that it is accessible from CS by pinging the FTP server. Use a storage device such as a compact flash or an IDE PCMCIA drive to save your configuration. 310

341 The following table describes the available fields and buttons in the Backup Config form if FTP is selected. Table 11-8: Expert > Backup Config Type FTP Form Fields and Buttons Field Server IP Path and Filename Username and Password Save Load Definition IP address of an FTP server on the same subnet as the CS. (Verify accessibility by pinging the FTP server.) Path of a directory on the FTP server where you have write access for saving the backup copy of the configuration file. Specify a filename if you want to save the file under another name. For example, to save the configuration file zvmppcbb.0720.bb in a directory called /upload on the FTP server, you would enter the following in the Path and Filename field: /upload/zvmppcbb.0720.bb Obtain the username and password to use from the FTP server s administrator. Saves the configuration Downloads a previously saved copy of the configuration file from the selected device. When Storage Device is selected from the Type pull-down menu, the following form appears. BLACK BOX CS Installation, Administration, and User s Guide 311

342 Administration Menu & Forms Figure 11-10: Expert > Administration > Backup Config > Storage Device The following table describes the available fields when Storage Device is selected from the Type drop-down menu. Table 11-9: Expert > Backup Config Type Storage Device Form Field Name Definition Default Configuration Replace Configuration The system saves the configuration in the storage device but does not override the internal flash configuration after reboot. The system saves the configuration in the storage device with a flag REPLACE that is used by the RESTORECONF utility to override the internal flash configuration after reboot. To Back Up or Restore the Configuration Files using an FTP Server 1. Go to Administration > Backup Config in Expert mode. The Backup Config form appears. 2. Select FTP from the Type pull-down menu. 3. Enter the IP address of the FTP server in the Server IP field. 4. Enter the directory path on the FTP server where you have write permissions in the Path and Filename field. Enter the filename after the 312

343 directory path. For example, /upload/zvmppccs.0720_qa.csk Enter the username and password provided by your system administrator for the FTP server. 6. To backup a copy of the current configuration files, press the Save button. 7. To download a previously saved copy of the configuration files, press the Load button. To Back Up or Restore the Configuration Files using a Storage Device 1. Go to Administration > Backup Config in Expert mode. The Backup Config form appears. 1. Select Storage Device from the Type pull-down menu. 2. To backup a copy of the current configuration files, select Default Configuration and press the Save button. 3. To restore a copy of the configuration files saved on the storage device without replacing the internal flash configuration, select Default Configuration and press the Load button. 4. Click apply changes 5. Reboot the system. See Administration > Reboot for details, if needed. 6. To replace the configuration saved on the storage device previously, select Replace Configuration and press the Save button. 7. To restore a copy of the configuration files saved on the storage device, and replace the internal flash configuration, select Replace Configuration and press the Load button. 8. Click apply changes 9. Reboot the system. See Administration > Reboot for details, if needed. Upgrade Firmware Selecting Administration > Upgrade Firmware in Expert mode brings up the form shown in the following figure. BLACK BOX CS Installation, Administration, and User s Guide 313

344 Administration Menu & Forms Figure 11-11: Expert > Administration > Upgrade Firmware You can use this form to configure an automated upgrade of the CS s firmware which includes the Kernel, applications, and configuration files. The firmware is upgradeable using an FTP server. You can upgrade the firmware directly through BLACK BOX FTP site at ftp://ftp.blackbox.com/lan/ Term-Servers/, or download the new firmware to a local FTP server and upgrade from there. Note: Check the file name for the upgrade version and read the upgrade instructions carefully. Distinct procedures are required depending on the version you are upgrading from. The following table describes the fields in the Upgrade Firmware form. Table 11-10: Expert > Upgrade Firmware Form Fields Field/Menu Definition Name Type FTP is the only supported type. 314

345 Field/Menu Name FTP Site Username Password Path and File Name Run Checksum Definition The URL of the FTP server where the firmware is located. This can be a local FTP server, or the BLACK BOX FTP site at ftp://ftp.blackbox.com/lan/term-servers/ Username recognized by the ftp server. Password associated with the username for the ftp server. The pathname of the firmware on the ftp server. For example, /blackbox/lan/term-servers/ LS1016A_LS1032A/v230/zvmppcbb.v230 Runs the checksum program to verify the accuracy of the uploaded data. To Upgrade the CS s firmware This procedure is for upgrading the latest release of the CS s firmware. The upgrade installs the software on the flash memory. 1. Go to Administration > Upgrade Firmware. The Upgrade Firmware form appears. 2. Choose FTP from the Type menu. (FTP is the only supported type). 3. Enter the URL of the ftp server in the FTP Site field. 4. Enter the username recognized by the ftp server in the Username field. 5. Enter the password associated with the username on the ftp server in the Password field. 6. Enter the pathname of the file on the ftp server in the Path and Filename field. 7. Click.the Upgrade Now button. 8. Click cancel changes if you need to restore the backed up configuration files. BLACK BOX CS Installation, Administration, and User s Guide 315

346 Administration Menu & Forms Reboot Selecting Administration > Reboot in Expert mode brings up the form shown in the following figure. Figure 11-12: Expert > Administration > Reboot Clicking the Reboot button reboots the CS. To Reboot the CS 1. Go to Administration > Reboot in Expert mode. 2. Click the Reboot button. A confirmation dialog box appears. 3. Click OK. 316

347 Online Help Selecting Administration > Online Help in Expert mode brings up the form shown in the following figure. Figure 11-13:Expert > Administration > Online Help BLACK BOX host the online-help on an FTP server accessible from the Internet. The path to the BLACK BOX FTP server is configured by default on CS and is viewable in the Online Help Path field as From any form in the Web Manager; pressing the Help button opens a new window and redirect its content to the configured path for the online help documentation. The CS administrator can download the online help, and reconfigure the path to a local server where the online help can be stored. The CS firmware stores the new link in flash and accesses the online help files whenever the help button is clicked. To Configure the Online Help Path 1. Using an FTP tool navigate to the FTP site where the online help is stored and download the desired version of the online help files. 2. In the CS Web Manager navigate to Administration > Online Help in Expert mode. BLACK BOX CS Installation, Administration, and User s Guide 317